Authentication

Bearer tokens for protected endpoints; no auth required on the free Discovery endpoints.

Bearer tokens

Every protected request carries:

Authorization: Bearer <token>

Tokens are minted by:

POST /subscribe — after a successful x402 / MPP payment
POST /auth — after a successful wallet-signature recovery

Bearer-gated endpoints

POST /sms/send
GET /sms/receive
GET /sms/messages
GET /number
POST /voice/dial
GET /voice/presence/<phone> (WS)
GET /voice/stream/<call_id> (WS)

Public endpoints (no auth)

GET /availability
POST /waitlist
POST /demo
POST /auth/nonce
POST /auth (signature replaces auth)

Token rotation on recovery

A successful POST /auth revokes every existing token for the wallet, then issues a single fresh one. Multi-agent setups must re-auth in lockstep.

What's NOT auth

API keys, OAuth, JWT, session cookies — none of those.
Headers other than Authorization — see Payment for the X-PAYMENT header on subscribe.