Authentication
Sign in to StonkTrader and call protected user and watchlist APIs.
The public API supports two ways to authenticate. Both resolve to the same StonkTrader user record and authorize the same protected endpoints.
Discover the available methods
curl https://api.stonktrader.finance/auth/methodsPlatform access token
After signing in through the StonkTrader web application, use the current access token as a bearer credential:
const response = await fetch("https://api.stonktrader.finance/user", {
headers: {
Authorization: `Bearer ${accessToken}`,
},
});
const profile = await response.json();The token is short-lived. Retrieve the current token through the platform login SDK instead of storing it permanently.
Wallet login with SIWE
StonkTrader browser clients and command-line clients with a cookie jar can
create a signed session directly. Keep credentials: "include" on same-site
browser requests so the nonce and session cookies are preserved.
const api = "https://api.stonktrader.finance";
await fetch(`${api}/auth/siwe/nonce`, {
credentials: "include",
});
const messageResponse = await fetch(`${api}/auth/siwe/message`, {
method: "POST",
credentials: "include",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ address, chainId: 1 }),
});
const { data: { message } } = await messageResponse.json();
const signature = await walletClient.signMessage({ message });
await fetch(`${api}/auth/siwe/verify`, {
method: "POST",
credentials: "include",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ message, signature }),
});After verification, the same session can call a protected service:
const user = await fetch(`${api}/user`, {
credentials: "include",
}).then((response) => response.json());
const watchlist = await fetch(`${api}/watchlist`, {
credentials: "include",
}).then((response) => response.json());Public and protected routes
Health, deployment metadata, authentication discovery, market quotes, and the OpenAPI document are public. User profiles and watchlists require a valid StonkTrader session or bearer credential. Trading operations use wallet addresses, signatures, and route-specific validation.
Registered partner browser applications should use bearer credentials. Backend services and command-line clients can call the HTTPS API directly.