Skip to main content
Forkast uses a two-tier authentication flow modeled after common CLOB infrastructures. Every private request includes either an L1 wallet signature or an L2 API credential signature, depending on the action being performed.
Prefer a UI? Visit auth.forka.st to connect your wallet, generate credentials, list existing keys, or revoke them without crafting requests manually.

​
L1 authentication (wallet signature)

Creating or revoking API keys requires an EIP-712 signature produced by the Polygon wallet that owns the account.

​
Headers

HeaderDescription
FORKAST_ADDRESSPolygon address that owns the account.
FORKAST_SIGNATUREEIP-712 signature over the auth payload.
FORKAST_TIMESTAMPUnix timestamp (seconds) at signing time.
FORKAST_NONCEMonotonic nonce bound to the signature.

​
Typed data schema

{
  "domain": {
    "name": "ClobAuthDomain",
    "version": "1",
    "chainId": 137
  },
  "types": {
    "ClobAuth": [
      {"name": "address", "type": "address"},
      {"name": "timestamp", "type": "string"},
      {"name": "nonce", "type": "uint256"},
      {"name": "message", "type": "string"}
    ]
  },
  "message": {
    "address": "<signing address>",
    "timestamp": "<unix timestamp>",
    "nonce": "<uint256 nonce>",
    "message": "This message attests that I control the given wallet"
  }
}
The signed payload is never stored; Forkast validates it and discards the components after deriving credentials.

​
L2 authentication (API credentials)

Once an API key is issued, subsequent private requests authenticate with L2 headers derived from the secret and passphrase.
Need an immediate credential? Jump to Create API key for the raw request or use the auth.forka.st console.

​
Headers

HeaderDescription
FORKAST_ADDRESSPolygon address that originally generated the key.
FORKAST_SIGNATUREHMAC signature built from the API secret.
FORKAST_TIMESTAMPUnix timestamp (seconds) for replay protection.
FORKAST_API_KEYUUID v4 identifier returned by POST /auth/api-key.
FORKAST_PASSPHRASE64-character hex passphrase used to unwrap the secret client-side and included in every request.

​
Storage guarantees

  • The API secret and passphrase are never persisted by Forkast. They are generated deterministically from the wallet signature and returned once.
  • Because the passphrase travels with each request, use it to decrypt any local storage of the secret and treat both values as sensitive.
  • Revoking an API key invalidates the key/secret/passphrase trio immediately; list endpoints will omit revoked keys.

​
Which header to use?

ActionRequired header
POST /auth/api-keyL1
DELETE /auth/api-keyL2
GET /auth/api-keysL2
Order placement / cancellationL2
Public market data endpointsNone