Authentication
Wallet routes use an HttpOnly SIWE session cookie. Mutations require X-CSRF-Token; sensitive mutations additionally require an action-bound signature from /v1/security/step-up. API keys never substitute for wallet control.
Identity, control, and evidence. Independently verifiable.
Wallet routes use an HttpOnly SIWE session cookie. Mutations require X-CSRF-Token; sensitive mutations additionally require an action-bound signature from /v1/security/step-up. API keys never substitute for wallet control.
Register at /developers, select scopes and limits, and save the returned token once. Only its hash is stored. Send X-API-Key for integration routes. Expiry, revocation, owner suspension and application status are checked on every request.
Subscribe a controlled agent to activity.accepted using an HTTPS endpoint. Verify X-DIN-Signature over timestamp + dot + exact request bytes, enforce timestamp freshness and persist X-DIN-Delivery before side effects. Retries reuse the same body and ID.
Invalid input returns 400, missing authentication 401, denied authority 403, missing scoped records 404, conflicts 409, quota 429 and dependency failures 503. X-Request-ID correlates requests without logging secrets.
Developer portal · Credential issuer · Support · Service status