Skip to main content
The auth service issues and verifies the two credentials the rest of the API accepts, and mints the short-lived tickets used to open websockets. See Authentication for the signing scheme and worked examples.

Endpoints

Identity verification

Every account must pass identity verification before use. Until then POST /auth/login returns a kyc_challenge instead of a token. The challenge is a bearer token for the /auth/kyc routes and nothing else. No session means no API keys. Sign in again once GET /auth/kyc reports approved. Verification runs on Persona’s hosted flow. POST /auth/kyc/inquiry returns a one-time link. Open it in a browser. The flow returns to the console when the user is done. The decision arrives from Persona shortly after. A user can retry after an expired or failed attempt. A declined account stays closed unless an operator reverses the decision in Persona. An account that loses approval has its sessions and API keys revoked.

Scopes

Keys carry read, trade, and withdraw. Password sessions are capped at read and trade, so a session can never mint a withdraw-scoped key.