> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dev.symbiosis.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth

> Accounts, sessions, API keys, and websocket tickets

The auth service issues and verifies the two credentials the rest of the API
accepts, and mints the short-lived tickets used to open websockets.

See [Authentication](/authentication) for the signing scheme and worked examples.

## Endpoints

| Endpoint                             | Purpose                                                 |
| ------------------------------------ | ------------------------------------------------------- |
| `POST /auth/signup`                  | Create an account                                       |
| `POST /auth/login`                   | Exchange email and password for a session token         |
| `POST /auth/api-keys`                | Mint an API key (the only response carrying the secret) |
| `GET /auth/api-keys`                 | List the session user's keys                            |
| `DELETE /auth/api-keys/{api_key_id}` | Revoke a key                                            |
| `POST /auth/ws-ticket`               | Mint a read-only websocket ticket from a session        |
| `POST /auth/ws-ticket/signed`        | Mint a ticket inheriting an API key's scopes            |

## Scopes

Keys carry `read`, `trade`, and `withdraw`. Password sessions are capped at
`read` and `trade`, so a session can never mint a `withdraw`-scoped key.