Authentication - Xenarch

Publisher API key

Used by publishers to manage their account, sites, and settings.

curl https://xenarch.dev/v1/publishers/me \
  -H "Authorization: Bearer xk_pub_abc123..."

Prefix: xk_pub_
Generated at registration and on login (key rotation)
Stored as SHA-256 hash — the plaintext is returned once and cannot be retrieved
Rotate via POST /v1/publishers/me/api-key/rotate

Site token

Used by server middleware to create gates and verify access tokens.

curl -X POST https://xenarch.dev/v1/gates \
  -H "X-Site-Token: st_abc123..." \
  -H "Content-Type: application/json" \
  -d '{"url": "/premium-article"}'

Prefix: st_
Generated when a site is registered
Stored as SHA-256 hash — the plaintext is returned once
Scoped to a single site

Wallet address

Used by agents to query their profile and payment history. No cryptographic proof required — used for lookup only.

curl https://xenarch.dev/v1/agents/me \
  -H "X-Wallet-Address: 0x1234...abcd"

Must be a valid EVM address: 0x followed by 40 hex characters
No signature verification in MVP