Authentication

The API uses four access levels.

Managed storage: Privy access token

POST /storage/sign requires Authorization: Bearer <token>. The API verifies the token with the configured Privy app and uses its user ID to derive a tenant-scoped object path. Missing, expired, or revoked tokens return 401 Unauthorized.

Users: no authentication

POST /requests, GET /requests?signer=…, and GET /requests/{id} are public. User requests are self-authenticating: the EIP-712 signature embedded in params (signer, v, r, s) proves intent and is verified on-chain by the Forwarder, not by the API.

Relayers: ECDSA signature

Required for PATCH /requests/{id}, GET /requests?status=…, and GET /requests?chainName=…. Implemented in src/auth/relayerAuth.ts.

The relayer builds and signs an auth message, then sends three headers:

Header	Value
`X-Relayer-Address`	The relayer's Ethereum address.
`X-Relayer-Signature`	ECDSA signature of the auth message.
`X-Relayer-Timestamp`	Unix timestamp in milliseconds.

Auth message format:

DataPrism Relayer Auth
Timestamp: {timestamp}
Method: {HTTP method}
Path: {request path}
Body: {hash of the request body}

The server verifies that:

The timestamp is within 5 minutes of the current time.
The signature is valid (viem.verifyMessage).
The recovered address is in the relayer whitelist (dataprism-relayers-{stage} table).

Any failure returns 401 Unauthorized.

Admin: API key

Required for all /admin/relayers routes. Send the X-Admin-Key header; its value must exactly match the ADMIN_API_KEY environment variable (verified by isAdminAuthorized() in src/handlers/admin/relayers.ts).

The default development value is dev-admin-key-change-me and must be changed in production. A missing or incorrect key returns 401 Unauthorized.