Auth

Authenticate user with BIP322 signature verification

post

Authenticates a user by verifying their BIP322 signature and creates a wallet with JWT tokens

Body

application/json

messagestringRequired

The message that was signed

Example: Sign this message to authenticate with the system

signaturestringRequired

The BIP322 signature of the message

Example: base64-encoded-signature

addressstringRequired

The Bitcoin address that signed the message

Example: bc1p...

publicKeystringRequired

The public key used for signing

Example: 02a1b2c3d4e5f6...

Responses

200

User authenticated successfully

application/json

codestringRequiredExample: 1

messagestringRequiredExample: common.success

dataobjectRequired

400

Invalid signature, invalid address, or authentication failed

application/json

post/api/auth/authenticate

HTTPcURLJavaScriptPython

POST /api/auth/authenticate HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 154

{
  "message": "Sign this message to authenticate with the system",
  "signature": "base64-encoded-signature",
  "address": "bc1p...",
  "publicKey": "02a1b2c3d4e5f6..."
}

{
  "code": "1",
  "message": "common.success",
  "data": {},
  "metaData": {
    "totalItems": 1,
    "currentPage": 1,
    "pageSize": 1,
    "totalPages": 1
  }
}

Refresh access token using refresh token

post

Body

application/json

refreshTokenstringRequired

Refresh token to generate new access token

Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Responses

200

New access token and rotated refresh token generated successfully

No content

400

Invalid or expired refresh token

application/json

post/api/auth/refresh-token

HTTPcURLJavaScriptPython

POST /api/auth/refresh-token HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 58

{
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

No content

Get WebAuthn challenge for passkey registration or login

get

Responses

200Success

No content

get/api/auth/webauthn/challenge

HTTPcURLJavaScriptPython

GET /api/auth/webauthn/challenge HTTP/1.1
Host: api.bound.exchange
Accept: */*

200Success

No content

Request email OTP for registration — sends a 6-digit code to the given email address

post

Body

application/json

emailstringRequired

Email address to send OTP to

Responses

200

OTP queued

No content

400

Email already registered

429

Rate limit exceeded

post/api/auth/email-verification/request

HTTPcURLJavaScriptPython

POST /api/auth/email-verification/request HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 16

{
  "email": "text"
}

No content

Register a new bound wallet account

post

Body

application/json

emailstringOptional

Required for SRP. Optional for passkey/wallet; validated when present.

otpstringOptional

Email OTP. Required whenever an email is supplied (any authType).

authTypestring · enumRequiredPossible values:

referralCodestringOptional

Referral code (base64url-encoded referrer accountId). Throws if invalid.

Responses

201

Account registered successfully

No content

post/api/auth/register

HTTPcURLJavaScriptPython

POST /api/auth/register HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 728

{
  "email": "text",
  "otp": "text",
  "authType": "passkey",
  "passkey": {
    "challengeId": "text",
    "credentialId": "text",
    "webauthnPublicKey": "text",
    "attestation": "text",
    "clientDataJson": "text",
    "authenticatorData": "text",
    "encryptedBlob": "text",
    "deviceName": "text"
  },
  "srpData": {
    "srpSalt": "text",
    "srpVerifier": "text",
    "encryptedBlob": "text",
    "passwordHint": "text"
  },
  "walletAuth": {
    "address": "text",
    "chain": "evm",
    "publicKey": "text",
    "provider": "text",
    "challengeId": "text",
    "signature": "text",
    "encryptedBlob": "text"
  },
  "wallets": {
    "btc": {
      "publicKey": "text",
      "address": "text",
      "message": "text",
      "signature": "text"
    },
    "evm": {
      "publicKey": "text",
      "message": "text",
      "signature": "text"
    },
    "sol": {
      "publicKey": "text",
      "message": "text",
      "signature": "text"
    }
  },
  "referralCode": "text"
}

201

Account registered successfully

No content

Login with passkey or password

post

Body

application/json

credentialIdstringRequired

challengeIdstringRequired

Responses

200

Login successful

No content

post/api/auth/passkey/login

HTTPcURLJavaScriptPython

POST /api/auth/passkey/login HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 136

{
  "credentialId": "text",
  "challengeId": "text",
  "webauthnAssertion": {
    "authenticatorData": "text",
    "clientDataJson": "text",
    "signature": "text"
  }
}

200

Login successful

No content

SRP step 1 — get salt and server public key

post

Client sends email. Server returns salt and serverPublic (B) for SRP-6a authentication.

Body

application/json

emailstringRequired

Account email

Responses

200

Returns sessionId, salt, and serverPublic (B)

No content

post/api/auth/srp/init

HTTPcURLJavaScriptPython

POST /api/auth/srp/init HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 16

{
  "email": "text"
}

200

Returns sessionId, salt, and serverPublic (B)

No content

Logout — revoke current session and refresh token

post

Authorizations

bearer

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

Logged out successfully

No content

post/api/auth/logout

HTTPcURLJavaScriptPython

POST /api/auth/logout HTTP/1.1
Host: api.bound.exchange
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200

Logged out successfully

No content

SRP step 2 — verify client proof and complete login

post

Client sends clientPublic (A) and clientProof (M1). Server verifies and returns serverProof (M2) plus tokens.

Body

application/json

sessionIdstringRequired

Session ID returned by srp/init

clientPublicstringRequired

Client ephemeral public key A = g^a mod N (base64)

clientProofstringRequired

Client proof M1 = H(H(N)⊕H(g) || H(I) || salt || A || B || K) (base64)

Responses

200

Login successful — returns serverProof, tokens, and encryptedBlob

No content

post/api/auth/srp/verify

HTTPcURLJavaScriptPython

POST /api/auth/srp/verify HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 63

{
  "sessionId": "text",
  "clientPublic": "text",
  "clientProof": "text"
}

200

Login successful — returns serverProof, tokens, and encryptedBlob

No content

Wallet auth — issue a fresh login nonce for an auth wallet address

get

Query parameters

addressstringRequired

Auth wallet address to issue a login nonce for

Responses

200

Returns challengeId, challenge (nonce), expiresAt

No content

get/api/auth/wallet/challenge

HTTPcURLJavaScriptPython

GET /api/auth/wallet/challenge?address=text HTTP/1.1
Host: api.bound.exchange
Accept: */*

200

Returns challengeId, challenge (nonce), expiresAt

No content

Wallet auth — log in by signing the issued nonce

post

Body

application/json

addressstringRequired

Registered auth wallet address

challengeIdstringRequired

challengeId from GET /auth/wallet/challenge

signaturestringRequired

Wallet signature over the issued server nonce

Responses

200

Login successful — tokens, encryptedBlob, account, wallets

No content

post/api/auth/wallet/login

HTTPcURLJavaScriptPython

POST /api/auth/wallet/login HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 58

{
  "address": "text",
  "challengeId": "text",
  "signature": "text"
}

200

Login successful — tokens, encryptedBlob, account, wallets

No content

2FA TOTP verify — exchange pending token + OTP code for full JWT pair

post

Accepts the pendingToken returned by srp/verify when 2FA is enabled, plus the current TOTP code. Returns the full login response.

Body

application/json

object · TotpVerifyDtoOptional

Responses

200

OTP verified — returns accessToken, refreshToken, encryptedBlob, account, wallets

No content

400

Invalid or expired pendingToken, or wrong OTP code

post/api/auth/2fa/verify

HTTPcURLJavaScriptPython

POST /api/auth/2fa/verify HTTP/1.1
Host: api.bound.exchange
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

No content