Authentication
Most of the market API queries require the use of an authentication token, which can easily be generated by Universe Owners signing with the corresponding private key.
The token is formed by signing the (salted) unix epoch time with the universe private key. Tokens are valid for 5 minutes. Basically:
The http header should look like this:
It is up to each application to create such token with each request (the computational cost is negligible), or to refresh it when expired.
This token authorizes universe owners to send transactions to the L2 nodes. In many GraphQL mutations, explicit asset owner signatures are also required, proving their explicit intent to trade their assets: owners' signatures are ultimately checked by the L2 nodes.
Here's some example code, extracted from the examples repository, which uses a couple of simple help functions in this NPM package.
List of API Calls Requiring Authentication
The list below contains all the operations in the API that need Authentication to be executed:
Operation | Purpose |
---|---|
| Change the alias of a web3 address |
| Binds a web3 address to an email. Explained in detail here. |
| Same as |
| Removes the web3 address to an email (previously set through a |
| Same as |
| Starts the payment for a sale operation. Explained here. |
Last updated