Spot API authentication
Buyer traffic uses Authorization: Bearer <buyer_key> under /buy/api/v1.
Seller traffic uses X-Seller-API-Key under /sell/api/v1 except the initial
POST /sell/api/v1/register. Advanced Market routes retain their operation-
specific authentication. Internal and admin headers are rejected at the public
apex boundary.
Authentication runs before rate limiting. A missing or invalid credential returns 401 with { "code": "unauthorized", "error": "..." }, not 429 rate_limited. See Errors and Rate limits.
| audience | header | used on |
|---|---|---|
| Buyer | Authorization: Bearer <buyer_key> | /buy/api/v1/* where required |
| Seller | X-Seller-API-Key: <seller_key> | /sell/api/v1/* after register |
| Public | none | POST /sell/api/v1/register, public Market reads |
POST /sell/api/v1/register is public only for a new endpoint_url. Changing the
key on an endpoint that is already registered requires the current key — see
Re-registration.
The focused Seller API scopes profile, offers, trade history, deliveries, and reputation to the seller derived from the key; callers cannot select another seller by putting an id in the route.