Authentication

All trading endpoints require a sessionId, obtained via the two-step session protocol. A session is bound to a wallet address (0xABC) and can be authenticated either by the wallet itself or by a registered API key (0xXYZ). Sessions expire after a fixed TTL (1 hour) and can be explicitly revoked.

Session handshake

1. POST /session/start with { “user”: “0xABC…” } — server returns a single-use challenge.
2. Compute keccak256(challenge) and sign the raw hash with secp256k1 ECDSA (NOT EIP-191 / personal_sign).
3. POST /session/complete with { challengeId, signature } — server verifies and returns a sessionId.
4. Use the sessionId in every /session/* call. On expiry or session-not-found, repeat from step 1.