Skip to main content
Solana AI Gateway uses a two-stage auth model. You prove wallet ownership with an Ed25519 signature to claim a credit-backed API key, then send that key on every subsequent request.

​
The two stages

1

Claim (one-time, per key)

Request a challenge, sign it with your wallet, and POST the signature. The gateway verifies the signature and returns your API key exactly once.
2

Call (per request)

Send the API key in the x-api-key header. The paywall middleware validates the key and debits your credit balance.

​
Sending the API key

Add the key as an HTTP header on every paid endpoint:
Public endpoints (/api/solana/balance, /api/solana/blockhash, /api/keys/challenge) do not require a key.

​
How signatures are verified

The server:
  1. Decodes your wallet address as a Solana PublicKey.
  2. Decodes the signature from base58.
  3. Verifies nacl.sign.detached.verify(challenge, signature, publicKey).
  4. On success, atomically deletes the pending row and returns the key.
If the signature is invalid, you get 401 Invalid signature. If no pending key exists for the wallet, you get 404 No pending key found; top up the wallet first.

​
Rotating a key

To rotate, top up the wallet again to provision a new pending key, then re-run the claim flow. Old keys remain valid until they run out of credits or are revoked server-side.
Treat the API key like a bearer token. Anyone with the key can spend your credits until it is depleted.

Wallet signatures

The cryptography behind claim verification.

Keys and credits

How balances are tracked and debited.