Authentication

Computalot supports two authentication methods for beta-approved users. Both produce a bearer token used on protected endpoints.

Open access. Any wallet can authenticate and fund an account — no allowlist entry needed. API keys (flk_...) are issued on request via the waitlist; POST /api/v1/auth/register self-service issuance remains disabled.

Method	Token prefix	How to get one
Wallet auth	`fls_...`	Challenge/verify flow (any wallet)
API key	`flk_...`	Admin-issued

Wallet auth

The recommended self-serve path for agents. Your wallet is your identity — the session token is a short-lived credential.

1. Request a challenge:


curl -sS https://computalot.com/api/v1/auth/wallet/challenge \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"wallet_address":"0xYOUR_WALLET","chain":"base"}'

2. Sign the returned challenge.message with your wallet.

3. Verify:


curl -sS https://computalot.com/api/v1/auth/wallet/verify \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "challenge_id":"wch_...",
    "wallet_address":"0xYOUR_WALLET",
    "signature":"0xSIGNED_MESSAGE"
  }'

Returns a token (fls_...) and account metadata. Use it as:


Authorization: Bearer fls_...

Wallet auth creates or reuses an account linked to your chain + wallet_address. That account owns all your projects, jobs, results, and credits. Use the same token to inspect billing truth on GET /api/v1/account/balance, GET /api/v1/account/holds, GET /api/v1/account/ledger, and GET /api/v1/account/quotes.

API keys

API keys (flk_...) work the same way as wallet tokens for all endpoints. They are issued on request via the waitlist.


Authorization: Bearer flk_...

API keys reach the same account billing endpoints as wallet sessions. If a project-init or job-submit request returns a shortfall quote, inspect those account endpoints, fund the account through your supported beta path, and retry the same blocked request.

Public endpoints

These endpoints require no authentication:

Endpoint	Description
`GET /health`	Liveness probe (same body as `/live`)
`GET /live`	Liveness probe
`GET /ready`	Readiness probe (`503` until controller core is up)
`GET /docs`	Documentation site
`GET /llms.txt`	Compact API reference
`GET /llms-full.txt`	Full reference with tutorials
`GET /skill.md`	Agent skill file
`GET /api/v1/docs`	Machine-readable JSON index
`GET /api/v1/docs/*`	Individual doc pages
`POST /api/v1/auth/register`	Disabled self-service registration (`403` with beta guidance)
`POST /api/v1/auth/wallet/challenge`	Start wallet auth
`POST /api/v1/auth/wallet/verify`	Complete wallet auth
`POST /api/v1/feedback`	Submit feedback

Operator-gated and protected endpoints

GET /metrics is not a public endpoint. It requires a local request, admin auth, or a dedicated metrics token.
Protected product endpoints such as GET /api/v1/jobs, GET /api/v1/account/balance, POST /api/v1/projects, and POST /api/v1/jobs require a bearer token.