> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xenarch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Xenarch API authentication — API key, site token, and wallet address auth methods for publishers and AI agents on the x402 payment API.

## Publisher API key

Used by publishers to manage their account, sites, and settings.

```bash theme={null}
curl https://xenarch.dev/v1/publishers/me \
  -H "Authorization: Bearer xk_pub_abc123..."
```

* Prefix: `xk_pub_`
* Generated at registration and on login (key rotation)
* Stored as SHA-256 hash — the plaintext is returned once and cannot be retrieved
* Rotate via `POST /v1/publishers/me/api-key/rotate`

## Site token

Used by server middleware to create gates and verify access tokens.

```bash theme={null}
curl -X POST https://xenarch.dev/v1/gates \
  -H "X-Site-Token: st_abc123..." \
  -H "Content-Type: application/json" \
  -d '{"url": "/premium-article"}'
```

* Prefix: `st_`
* Generated when a site is registered
* Stored as SHA-256 hash — the plaintext is returned once
* Scoped to a single site

## Wallet address

Used by agents to query their profile and payment history. No cryptographic proof required — used for lookup only.

```bash theme={null}
curl https://xenarch.dev/v1/agents/me \
  -H "X-Wallet-Address: 0x1234...abcd"
```

* Must be a valid EVM address: `0x` followed by 40 hex characters
* No signature verification in MVP