Authentication

Create a master API key from the signed-in app after completing email verification. Send the key from your backend and keep it in a server-side secret manager.

A master key can export wallet recovery material, transfer balances, submit trades to external recipients, and issue settlement tickets. Treat it as custody-equivalent.

Send the bearer token

Add the authorization header to authenticated /v1 requests. Public resources, such as GET /v1/protocol/tvl and shared PnL cards, do not require a key.

Authorization: Bearer ss_live_<id>_<secret>

Protect the key

Do not expose a master key in browser code, mobile builds, logs, or analytics events. Revoke it from the API keys page if it may have leaked.

Use a fresh Idempotency-Key for each wallet or financial mutation. Persist the key and request before sending it, then reuse both when retrying that operation. Read the endpoint's schema for headers on other account operations.

Browser sessions

The signed-in app uses a session cookie. Its state-changing requests must also send X-CSRF-Token from the separate CSRF cookie. Bearer-key requests do not need the CSRF header.

Creating, rotating, and revoking master keys requires a browser session. Creation and rotation also require a fresh email code. Wallet import, bulk wallet export, referral-code changes, and giveaway entry are browser-only operations. A master key can export one owned wallet without an email code; browser exports require one.

StarSwap extension credentials

The StarSwap browser extension supports BasedBot through a separate scoped connection approved in the app. That credential is limited to the approved wallets, saved buy presets, slippage, market reads, and recovery of its own trades. New connections expire after 30 days.

A scoped credential cannot use the general wallet inventory, one-request trade execution, sells, withdrawals, transfers, exports, or key management. It uses the integration account and exact-token holding endpoints plus its bound quote, submission, and trade-status flow. See the extension guide for connection and recovery behavior. Use a master key for your own backend integration.