Authentication

Table of Contents

All billing endpoints require a Bearer token:

Authorization: Bearer macs_a1b2...c5d6

Key format

  • Prefix: macs_
  • Secret: 32 hex characters
  • Full key: 37 characters

Registration

POST /api/v1/register

No auth, no body. The response contains your API key and a USDC funding address on Base. Registration is rate-limited per source IP.

Key storage

The server stores only a SHA-256 hash of the key's secret part. The raw key is returned exactly once, at registration, and never again.

Consequences:

  • A database leak does not expose usable API keys.
  • A lost key cannot be recovered. Register a new account and fund the new address.

Rotation

There is no in-place rotation: keys are tied to an account and its balance. To rotate, register a new account, fund it, and retire the old key by letting it go idle. Each account is separate; balances do not transfer.