Ignite Authenticated Trading API

Authentication flow

The EIP-712 domain intentionally has no chain ID, so the login is not tied to the wallet's currently selected network.

curl -X POST https://api.ignite.trade/v1/auth/challenge \
  -H "Content-Type: application/json" \
  -d '{"address":"0xYOUR_WALLET"}'

{
  "typedData": {
    "domain": { "name": "Ignite DEX", "version": "1" },
    "types": { "Login": [
      { "name": "address", "type": "address" },
      { "name": "nonce", "type": "string" },
      { "name": "issuedAt", "type": "string" }
    ]},
    "primaryType": "Login",
    "message": {
      "address": "0xYOUR_WALLET",
      "nonce": "single-use-random-value",
      "issuedAt": "2026-07-27T12:00:00.000Z"
    }
  },
  "expiresIn": "5m"
}

// viem example
const challenge = await fetch('https://api.ignite.trade/v1/auth/challenge', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ address: account.address })
}).then((response) => response.json());

const signature = await walletClient.signTypedData({
  account,
  ...challenge.typedData
});

const session = await fetch('https://api.ignite.trade/v1/auth/verify', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ address: account.address, signature })
}).then((response) => response.json());

// { "verified": true, "token": "<session JWT>" }

Thanos Wallet signs an EIP-4361 SIWE message with personal_sign. Request a nonce for the wallet, build the SIWE message with the current Ignite domain and URI, sign that exact message, then verify it. The returned sessionToken is the same eight-hour bearer credential used by all protected routes.

const nonce = await fetch(
  'https://api.ignite.trade/api/auth/nonce?address=' + account.address
).then((response) => response.text());

// Use thanos-connect's buildSiweMessage() so the signed bytes match.
const message = buildSiweMessage({
  domain: window.location.host,
  address: account.address,
  uri: window.location.origin,
  statement: 'Sign in to Ignite DEX with your Thanos Wallet.',
  chainId,
  nonce,
  expirationTime: new Date(Date.now() + 5 * 60_000).toISOString()
});

const signature = await walletClient.signMessage({ account, message });
const { sessionToken } = await fetch('https://api.ignite.trade/api/auth/verify', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ address: account.address, message, signature })
}).then((response) => response.json());

The nonce endpoint answers text/plain (32 hex characters). It is valid for five minutes and one login; requesting another nonce for the same address replaces it. The server checks the following and nothing else: the personal_sign signature recovers to address; line 1 names an Ignite web host as the domain (ignite.trade or www.ignite.trade); line 2 is the same address; the Nonce: line carries the current nonce; and Expiration Time:, if present, is in the future. URI, Version, Chain ID, Statement and Issued At are not checked. Lines are separated by a single LF, with no trailing newline.

ignite.trade wants you to sign in with your Ethereum account:
0x1111111111111111111111111111111111111111

Sign in to Ignite DEX with your Thanos Wallet.

URI: https://ignite.trade
Version: 1
Chain ID: 1
Nonce: 3f6c1d0e9b8a7c6d5e4f30211a2b3c4d
Issued At: 2026-10-10T12:00:00.000Z
Expiration Time: 2026-10-10T12:05:00.000Z

Authoritative market rules

Read GET /v1/markets before submitting an order. Each market record is authoritative for symbol, type, status, tradingEnabled, feeBps, tickSize, minOrderSize, maxOrderSize, token symbols, and network ID.

Returns equity, free collateral, balances and positions for the authenticated wallet only. The path address must match the bearer-token subject; another wallet is rejected. reserved is held by your resting limit orders (bids hold quote, asks hold base); available is what new orders, liquidity deposits and withdrawals can use. Withdrawals are deducted from total when requested. amount equals total and is kept for compatibility.

curl https://api.ignite.trade/v1/portfolio/0xYOUR_WALLET \
  -H "Authorization: Bearer $IGNITE_TOKEN"

{
  "address": "0xyour_wallet",
  "equity": 1520.4,
  "freeCollateral": 1520.4,
  "balances": [
    { "asset": "USDC", "amount": 1200, "total": 1200, "reserved": 220.86, "available": 979.14 },
    { "asset": "SOL", "amount": 2.9, "total": 2.9, "reserved": 0, "available": 2.9 }
  ],
  "positions": []
}

curl -X POST https://api.ignite.trade/v1/orders \
  -H "Authorization: Bearer $IGNITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "market": "LITHO/USDT",
    "side": "buy",
    "type": "limit",
    "price": 8.70,
    "size": 1,
    "clientOrderId": "strategy-a-000001",
    "timeInForce": "GTC",
    "postOnly": false,
    "reduceOnly": false
  }'

An order the matching engine refuses comes back as HTTP 200 with accepted: false, status: "rejected" and a rejectCode with rejectReason: POST_ONLY_WOULD_CROSS or FOK_NOT_FILLED. They are sent on the placing response only; a clientOrderId replay returns the order without them.

Returns the wallet's latest 100 orders, newest first, in open and terminal states. Each order carries createdAt, updatedAt (last status or fill change), remainingSize, and every fill it took part in as taker or maker. The place-order response returns the same object as order, alongside createdAt and updatedAt.

curl https://api.ignite.trade/v1/orders \
  -H "Authorization: Bearer $IGNITE_TOKEN"

{ "orders": [{
  "id": "cmg…", "market": "SOL/USDC", "side": "sell", "type": "limit", "timeInForce": "GTC",
  "postOnly": true, "price": 110.5, "size": 2, "filledSize": 0.5, "remainingSize": 1.5,
  "status": "partially_filled", "clientOrderId": "strategy-a-000002",
  "createdAt": "2026-10-10T12:00:00.000Z", "updatedAt": "2026-10-10T12:03:10.000Z",
  "fills": [{ "id": "…", "orderId": "cmg…", "role": "maker", "price": 110.5, "size": 0.5,
              "notional": 55.25, "feeAmount": 0, "feeAsset": "USDC", "createdAt": "2026-10-10T12:03:10.000Z" }]
}] }

Only the authenticated owner can cancel a live order. Filled, rejected, expired, failed, or already-cancelled orders cannot be cancelled (ORDER_NOT_FOUND).

curl -X DELETE https://api.ignite.trade/v1/orders/ORDER_ID \
  -H "Authorization: Bearer $IGNITE_TOKEN"

Cancels every open, resting and partially filled order the wallet has when the request runs, each exactly as the single cancel would; a partially filled order ends partially_filled_cancelled. The optional market filter takes the published symbol, URL-encoded. It works while trading is paused, so it can be used as an emergency stop. Orders placed after the call starts are not included; an unknown market is MARKET_NOT_FOUND.

curl -X DELETE "https://api.ignite.trade/v1/orders?market=SOL%2FUSDC" \
  -H "Authorization: Bearer $IGNITE_TOKEN"

{
  "cancelled": [
    { "id": "cmh…", "clientOrderId": "strategy-a-000002", "market": "SOL/USDC", "status": "cancelled" },
    { "id": "cmh…", "clientOrderId": null, "market": "SOL/USDC", "status": "partially_filled_cancelled" }
  ],
  "count": 2
}

Returns fills where the authenticated wallet was maker or taker, newest first. The optional limit is clamped to 1–500 and the optional market filter uses the published market symbol. Each fill has orderId (your order), side, role, notional, and the fee you paid as feeAmount in feeAsset (0 as maker).

{ "trades": [{
  "id": "…", "orderId": "cmh…", "market": "SOL/USDC", "side": "buy", "role": "taker",
  "price": 110.5, "size": 0.5, "notional": 55.25, "feeAmount": 0.05525, "feeAsset": "USDC",
  "counterparty": "0x…", "createdAt": "2026-10-10T12:03:10.000Z"
}] }

Responses and integration safety

Every error carries a stable code next to the message: { "error": string, "code": string }. Validation failures put the field details in error; unknown routes and unexpected errors use { "statusCode", "code", "error", "message" }. Branch on code, not on the message text, which may be reworded. Codes are never renamed or reused; new ones may be added. Route-specific codes keep their values: STALE_TERMS_VERSION (409), the lowercase Thanos login codes above, and Fastify FST_ERR_* codes for malformed HTTP requests such as invalid JSON.

Rate limits

Limits count requests per bearer token (per IP without one) over a sliding 60-second window. Limited routes send RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. RateLimit-Reset is always an absolute Unix time in seconds: when the oldest request in the window expires. A 429 also sends Retry-After in seconds.

Public WebSocket streams

No authentication. Both streams push full snapshots every two seconds (not diffs); REST remains the reference.

Private order and fill streams are not available; poll GET /v1/orders and GET /v1/trades.

Admin, custody-operator, RPC credentials, internal service routes, and automation-signer details are intentionally outside this public integration contract.