API Authentication

Obtaining an API Key

1. Create an Account: Sign up for a Solana Index Fund account and complete the verification process.
2. Navigate to API Settings: In your account dashboard, go to the "API Settings" section.
3. Generate API Key: Click on "Generate API Key" and provide a name and description for the key.
4. Select Permissions: Choose the permissions you want to grant to the API key based on your needs.
5. Complete Generation: Click "Generate" to create the API key. Make sure to copy and store it securely, as it will only be shown once.

Using API Keys

To authenticate with an API key, include it in the Authorization header of your HTTP requests:

Authorization: Bearer YOUR_API_KEY

Example request using cURL:

curl -X GET "https://api.sindex.world/v1/user/portfolio" \ -H "Authorization: Bearer YOUR_API_KEY"

API Key Security Best Practices

• Never expose API keys in client-side code (JavaScript, mobile apps, etc.) where they could be extracted by users.
• Use environment variables to store API keys in your server-side applications rather than hardcoding them.
• Implement the principle of least privilege by only granting the permissions that are necessary for your use case.
• Rotate API keys regularly, especially if you suspect they may have been compromised.
• Monitor API key usage to detect unusual patterns that might indicate unauthorized access.

JWT Authentication Flow

1. Wallet Authentication: The user authenticates with their Solana wallet by signing a message using the signMessage API (or legacy signTransaction for older wallets).
2. Signature Verification: The server verifies the signature against the user's public key using ed25519 verification.
3. Token Issuance: Upon successful verification, the server issues an access token (JWT) and a refresh token.
4. Token Usage: The client includes the access token in the Authorization header of subsequent API requests.
5. Token Verification: The server verifies the token's signature and expiration before processing the request.
6. Token Refresh: When the access token expires, the client can use the refresh token to obtain a new access token without requiring the user to re-authenticate.

Using JWT Authentication

To authenticate with a JWT, include it in the Authorization header of your HTTP requests:

Authorization: Bearer YOUR_JWT_TOKEN

Example request using JavaScript fetch:

fetch('https://api.sindex.world/v1/user/portfolio', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer ' + jwtToken,
    'Content-Type': 'application/json'
  }
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));

JWT Token Structure

A JWT consists of three parts separated by dots: header, payload, and signature.

{
  "alg": "RS256",
  "typ": "JWT"
}

{
  "sub": "user_123456",
  "wallet": "7Lf2U6kZK6TqJ4d4BWK3TYsy7ZrXksu5oEAXpgAHbMR9",
  "permissions": [
    "read:index",
    "read:portfolio",
    "write:transactions"
  ],
  "iat": 1684152000,
  "exp": 1684238400,
  "nonce": "a1b2c3d4e5f6"
}

Refresh Token Flow

1. Detect Expired Token: When an API request returns a 401 Unauthorized error with the reason "token_expired", it's time to refresh the token.
2. Send Refresh Request: Make a POST request to the token refresh endpoint with the refresh token.
3. Receive New Tokens: If the refresh token is valid, the server will issue a new access token and possibly a new refresh token.
4. Update Stored Tokens: Replace the old tokens with the new ones in your application's storage.
5. Retry Original Request: Retry the original API request with the new access token.

Refresh Token Endpoint

To refresh an access token, make a POST request to the token refresh endpoint:

POST https://api.sindex.world/v1/auth/refresh

Request body:

{
  "refresh_token": "YOUR_REFRESH_TOKEN"
}

Response example:

{
  "success": true,
  "data": {
    "access_token": "NEW_ACCESS_TOKEN",
    "refresh_token": "NEW_REFRESH_TOKEN",
    "expires_in": 86400
  }
}

Rate Limit Headers

The API includes rate limit information in the response headers: