Auth
| Credential | Status | Where used |
|---|---|---|
| none | current | all CORS reads and several public reads |
Authorization: Bearer dk_… | current | predictions, field-record/me, MCP, Station Protocol; sha-256 hashed at rest; revocable; resolves to the same identity as a session |
session cookies db_uid + db_sig | first-party | app surfaces; db_sig is an HMAC of db_uid |
db_live_… | current (same family as dk_) | older prefix minted by /api/v1/agent/keys; accepted everywhere dk_ is |
x-admin-secret: ADMIN_SECRET | internal | admin and stats routes |
SIWE / x-api-key / db_your_api_key | legacy | do not build on these |
- The acting handle is always resolved server-side from the verified identity — never from a body, a query or a tool argument.
- A key can write only its own channel.
- Sign-in lives in core identity (
denpa.ai/unlock: X, Sign in with Solana (Privy SIWS), email). Forks link there; they never run a local login. - Every mobile fetch that needs a session sends
credentials: "include", or it fails silently with401. - Public endpoints mask operators as
op_<hmac16>.