Authentication

API keys

Send your key on every request, in either header:

Authorization: Bearer syn_your_key_here

x-api-key: syn_your_key_here

Requests without a valid, active key get 401:

{ "error": { "message": "Missing or invalid API key. Send it as: Authorization: Bearer syn_..." } }

Creating and managing keys

• Create keys on API keys after connecting your wallet. You can hold up to 10 active keys.
• The full key is shown once. Synaps stores only a one-way hash and the first characters, so a lost key cannot be recovered; create a new one.
• Daily limit (optional): a USD cap per key per UTC day. When the key's spending for the day reaches it, further paid requests return 429 until midnight UTC.
• Revoke a key at any time. It stops working on the next request.

Wallet sign-in (app)

The web app signs you in with a message signature, not a password:

1. You pick a wallet in the connect window and it shares its address.
2. Synaps creates a one-time nonce that expires after 10 minutes.
3. You sign a readable message containing your address and that nonce. No gas, no transaction, no approvals.
4. Synaps verifies the signature and sets a secure, HTTP-only session cookie valid for 7 days.

The wallet picker is powered by Privy. It supports browser extensions such as MetaMask, Rabby and Coinbase Wallet, and WalletConnect, so you can sign in from any phone browser by approving in your mobile wallet app. Standard wallets (EOAs) are supported; smart-contract wallets are not yet.

Checking a key

Send a one-token request. A 200 means the key is valid; 401 means it is wrong or revoked; 402 means the key works but the balance is too low for a paid model.

curl https://www.synaps.chat/api/v1/chat/completions \
  -H "Authorization: Bearer $SYNAPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"deepseek/deepseek-chat","max_tokens":1,"messages":[{"role":"user","content":"hi"}]}'

GET /models is public and does not check the key.