strike-authlisted

# Strike auth Public market data needs no credential (`strike-market-data`). Everything else - the account, positions, history, and every order - is signed with the desk's **API wallet**. ## 1. What an API wallet is An Ed25519 keypair you generate yourself and register with your Strike account. It signs trading requests on the account's behalf. It is not your Cardano wallet, and it is not a seed phrase. **What it can do:** read the account, place, replace and cancel orders, change leverage and margin mode, run TWAPs. **What it cannot do:** neither the trade API nor the user API exposes a withdraw, deposit or transfer endpoint. `withdraw` appears only as a read-only transaction-history type and a `maxWithdrawAmount` field. Moving money happens in the Strike app, with you, through a flow that needs a chain signature this key cannot produce. That is the bounded credential the desk is built around: it can trade, and it cannot take the money out. Treat it as trade-only, and still keep on Strike only what the desk is meant to be trading. ## 2. Generate the keypair On the desk computer, with nothing installed: ```bash umask 077 openssl genpkey -algorithm ed25519 -out /tmp/api-wallet.pem # Private key seed - 64 hex characters. This is the secret. openssl pkey -in /tmp/api-wallet.pem -outform DER | tail -c 32 | xxd -p -c 64 # Public key - 64 hex characters. This is what you register. openssl pkey -in /tmp/api-wallet.pem -pubout -outform DER | tail -c 32 | xxd -p -c 64 ```