API Reference

Authentication

Octo accepts a bearer token in the Authorization header. There are two kinds, for two audiences:

API key (server-to-server)

Your integration backend uses a per-wallet API key (octo_sk_test_… on testnet). The key maps to exactly one wallet, so wallet operations for that wallet are authorized automatically.

Authorization: Bearer octo_sk_test_ab12…

An API key can:

• create and list deposit addresses,
• read the wallet, balances, and transactions,
• register webhook endpoints.

Login token (dashboard)

The dashboard authenticates users with a session JWT from POST /v1/auth/login. It authorizes everything its owner can do — including creating wallets and withdrawing — across all wallets the user owns.

# obtain a login token
curl -X POST http://localhost:8080/v1/auth/login \
  -H "content-type: application/json" \
  -d '{ "email": "you@acme.com", "password": "•••••••••" }'

# → { "data": { "token": "eyJ…", "user": { … } } }