Auth - Symbiosis

The auth service issues and verifies the two credentials the rest of the API accepts, and mints the short-lived tickets used to open websockets. See Authentication for the signing scheme and worked examples.

Endpoints

Endpoint	Purpose
`POST /auth/signup`	Create an account
`POST /auth/login`	Exchange email and password for a session token
`POST /auth/api-keys`	Mint an API key (the only response carrying the secret)
`GET /auth/api-keys`	List the session user’s keys
`DELETE /auth/api-keys/{api_key_id}`	Revoke a key
`POST /auth/ws-ticket`	Mint a read-only websocket ticket from a session
`POST /auth/ws-ticket/signed`	Mint a ticket inheriting an API key’s scopes

Scopes

Keys carry read, trade, and withdraw. Password sessions are capped at read and trade, so a session can never mint a withdraw-scoped key.

⌘I