Skip to main content
Kuest uses a two-tier authentication flow modeled after common CLOB infrastructures. Every private request includes either an L1 wallet signature or an L2 API credential signature, depending on the action being performed.
Prefer a UI? Visit auth.kuest.com to connect your wallet, generate credentials, list existing keys, or revoke them without crafting requests manually.

​
L1 authentication (wallet signature)

Creating or revoking API keys requires an EIP-712 signature produced by the Polygon wallet that owns the account.

​
Headers

HeaderDescription
KUEST_ADDRESSPolygon address that owns the account.
KUEST_SIGNATUREEIP-712 signature over the auth payload.
KUEST_TIMESTAMPUnix timestamp (seconds) at signing time.
KUEST_NONCEMonotonic nonce bound to the signature.

​
Typed data schema

{
  "domain": {
    "name": "ClobAuthDomain",
    "version": "1",
    "chainId": 137
  },
  "types": {
    "ClobAuth": [
      {"name": "address", "type": "address"},
      {"name": "timestamp", "type": "string"},
      {"name": "nonce", "type": "uint256"},
      {"name": "message", "type": "string"}
    ]
  },
  "message": {
    "address": "<signing address>",
    "timestamp": "<unix timestamp>",
    "nonce": "<uint256 nonce>",
    "message": "This message attests that I control the given wallet"
  }
}
The signed payload is never stored; Kuest validates it and discards the components after deriving credentials.

​
L2 authentication (API credentials)

Once an API key is issued, subsequent private requests authenticate with L2 headers derived from the secret and passphrase.
Need an immediate credential? Jump to Create API key for the raw request or use the auth.kuest.com console.

​
Headers

HeaderDescription
KUEST_ADDRESSPolygon address that originally generated the key.
KUEST_SIGNATUREHMAC signature built from the API secret.
KUEST_TIMESTAMPUnix timestamp (seconds) for replay protection.
KUEST_API_KEYUUID v4 identifier returned by POST /auth/api-key.
KUEST_PASSPHRASE64-character hex passphrase used to unwrap the secret client-side and included in every request.

​
Storage guarantees

  • The API secret and passphrase are never persisted by Kuest. They are generated deterministically from the wallet signature and returned once.
  • Because the passphrase travels with each request, use it to decrypt any local storage of the secret and treat both values as sensitive.
  • Revoking an API key invalidates the key/secret/passphrase trio immediately; list endpoints will omit revoked keys.

​
Which header to use?

ActionRequired header
POST /auth/api-keyL1
DELETE /auth/api-keyL2
GET /auth/api-keysL2
Order placement / cancellationL2
Public market data endpointsNone