x-api-key header. Most also carry a signed message proving the user owns user_address, and this page has the exact message for each one.
Signing Requests
Every POST needs a signed message except/commit and /borrow/commit. The GET endpoints - /trade/one-time-wallet, /deposit_address and /health - need only the API key.
Sign with the user’s Solana keypair (Ed25519) and base64-encode the result. Timestamps are Unix time in milliseconds. Every message is the same two lines, and only Details: changes:
Each
Details: line below is the whole of what changes. Everything else - the field it travels in and how long it lasts - is in the table above.
Read Format
/account/balances, /account/points, /account/pending, /borrow/pending and /borrow/positions. Only the field name differs between them.
Trade Format
timestamp is second from last, before jito_tip_amount.
Withdraw Format
One-Time Wallet Format
GET /trade/one-time-wallet takes only the API key.
Lending Format
smart_wallet_id in front.
Settle Format
timestamp comes last here, and cleanup_leftover_sol is written exactly as it appears in the body (true or false).
Signing in Code
One helper covers every format - build theDetails: line and pass it in.
Every value you sign must exactly match the value you send in the request body. On the lending endpoints, a timestamp outside its window is rejected with
400, while a mismatched message or the wrong signing key returns 401 - see Handling 401 Errors.Next Steps
- Trading - Deposit, trade privately, and withdraw.
- Lending - Open a position, deploy the funds, then settle.
- Error Handling - Commit statuses and recovering interrupted flows.
