Authentication

Public reads need no auth. Everything that writes, and the /v1/me/* endpoints, act as a wallet. There are two ways to prove which wallet you are.

#Browser: wallet sign-in

The app asks the server for a nonce and has your wallet sign it with EIP-191 personal_sign. The server checks the signature and sets an HttpOnly session cookie. No transaction is sent and no gas is spent. This is how the app at dapp.filobook.run talks to the API.

Writes authenticated by the cookie must come from the app's own origin. A cross-origin POST or PATCH that relies on the cookie is refused with 403 forbidden. Requests with an API key are not affected.

#Code: API keys

Create a key in the app under Settings → API keys. Send it as a bearer token:

curl https://dapp.filobook.run/v1/me/orders \
  -H "Authorization: Bearer $FILOBOOK_KEY"

• Keys start with fb_live_ and are shown once, when you create them.
• Keys are created and revoked in the app only, with a wallet session. There is no public API endpoint for keys, and a key cannot create other keys.
• A wallet can have up to 10 active keys, and can create up to 10 keys per hour.
• A key belongs to the wallet that created it and acts as that wallet.
• The same wallet, and so the same key, can act as agent (post, cancel, fill) and as provider (register, quote).
• A missing, invalid or revoked key returns 401 unauthorized.