Authentication & Rate Limits

Public endpoints (no auth)

The following endpoints are publicly accessible without any authentication:

• GET /api/rates/[corridor]
• POST /api/intent/offramp
• GET /api/reputation/[anchor]
• GET /api/reputation/leaderboard
• GET /api/publisher/health
• GET /api/snapshot
• GET /v1/public/scores

Admin endpoints (header auth)

Admin endpoints require the X-Admin-Key header set to the ADMIN_SECRET_KEY environment variable.

curl -s https://stellar-intel.vercel.app/api/admin/disputes \
  -H 'x-admin-key: YOUR_ADMIN_SECRET_KEY'

• GET /api/admin/disputes
• POST /api/admin/disputes

Cron endpoints (bearer token)

Internal cron-triggered endpoints require an Authorization: Bearer CRON_SECRET header.

curl -s https://stellar-intel.vercel.app/api/publisher/tick \
  -H 'authorization: Bearer YOUR_CRON_SECRET'

• POST /api/publisher/tick
• POST /api/reputation/reconcile
• POST /api/reputation/refresh

Signed intent verification

The dispute endpoint uses Ed25519 cryptographic signature verification. The request body includes a signature over the intentHash that the server verifies before accepting the dispute.

curl -sX POST https://stellar-intel.vercel.app/api/reputation/dispute \
  -H 'content-type: application/json' \
  -d '{
    "intentHash": "abc123...",
    "publicKey": "GABC...",
    "signature": "base64-signature...",
    "anchorId": "cowrie",
    "reason": "Rate did not match quoted amount"
  }'