Authentication

SW4P has three authentication surfaces. Use the one that matches the route family you are calling.

SDK API Keys

Published SDK routes use X-API-Key.

bash · curl

curl https://api.sw4p.io/sdk/v1/pairs \
  -H "X-API-Key: sk_555_live_your_api_key"

Use this for:

/sdk/v1/*
/sdk/v2/*
builder SDK methods on Sw4pClient

API keys are created in the developer console and should be treated as server credentials. Do not ship live secret keys in browser bundles.

Wallet JWT Sessions

Wallet-owned app routes use a signed wallet login followed by Authorization: Bearer <jwt>.

bash · curl

curl -X POST https://api.sw4p.io/v1/auth/nonce \
  -H "Content-Type: application/json" \
  -d '{
    "wallet_address": "0x742d35Cc6634C0532925a3b844Bc9e7595f...",
    "chain_type": "EVM"
  }'

After signing the returned message, call /v1/auth/login and pass the returned token to wallet-authenticated routes:

bash · curl

curl https://api.sw4p.io/v1/auth/session \
  -H "Authorization: Bearer eyJ..."

Use this for user-owned surfaces such as relay preparation, wallet actions, and current smart-account app routes.

x402 Facilitator

The following describes the source contract only. Production settlement is disabled during maintenance; do not submit a signed payment payload or send funds to test it.

The x402 facilitator verifies signed payment payloads on /x402/verify and settles accepted payloads on /x402/settle. These routes authenticate the payment payload itself rather than an SDK API key.

bash · curl

curl -X POST https://api.sw4p.io/x402/verify \
  -H "Content-Type: application/json" \
  -d '{
    "paymentPayload": {},
    "paymentRequirements": {}
  }'

Error Contract

Authentication failures return 401. Rate-limit failures return 429.

json

{
  "error": "UNAUTHORIZED",
  "message": "Invalid or missing credentials"
}