Ignite Authenticated Trading API

Authentication flow

The EIP-712 domain intentionally has no chain ID, so the login is not tied to the wallet's currently selected network.

curl -X POST https://api.ignite.trade/v1/auth/challenge \
  -H "Content-Type: application/json" \
  -d '{"address":"0xYOUR_WALLET"}'

{
  "typedData": {
    "domain": { "name": "Ignite DEX", "version": "1" },
    "types": { "Login": [
      { "name": "address", "type": "address" },
      { "name": "nonce", "type": "string" },
      { "name": "issuedAt", "type": "string" }
    ]},
    "primaryType": "Login",
    "message": {
      "address": "0xYOUR_WALLET",
      "nonce": "single-use-random-value",
      "issuedAt": "2026-07-27T12:00:00.000Z"
    }
  },
  "expiresIn": "5m"
}

// viem example
const challenge = await fetch('https://api.ignite.trade/v1/auth/challenge', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ address: account.address })
}).then((response) => response.json());

const signature = await walletClient.signTypedData({
  account,
  ...challenge.typedData
});

const session = await fetch('https://api.ignite.trade/v1/auth/verify', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ address: account.address, signature })
}).then((response) => response.json());

// { "verified": true, "token": "<session JWT>" }

Thanos Wallet signs an EIP-4361 SIWE message with personal_sign. Request a nonce for the wallet, build the SIWE message with the current Ignite domain and URI, sign that exact message, then verify it. The returned sessionToken is the same eight-hour bearer credential used by all protected routes.

const nonce = await fetch(
  'https://api.ignite.trade/api/auth/nonce?address=' + account.address
).then((response) => response.text());

// Use thanos-connect's buildSiweMessage() so the signed bytes match.
const message = buildSiweMessage({
  domain: window.location.host,
  address: account.address,
  uri: window.location.origin,
  statement: 'Sign in to Ignite DEX with your Thanos Wallet.',
  chainId,
  nonce,
  expirationTime: new Date(Date.now() + 5 * 60_000).toISOString()
});

const signature = await walletClient.signMessage({ account, message });
const { sessionToken } = await fetch('https://api.ignite.trade/api/auth/verify', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ address: account.address, message, signature })
}).then((response) => response.json());

Authoritative market rules

Read GET /v1/markets before submitting an order. Each market record is authoritative for symbol, type, status, tradingEnabled, feeBps, tickSize, minOrderSize, maxOrderSize, token symbols, and network ID.

Returns equity, free collateral, balances and positions for the authenticated wallet only. The path address must match the bearer-token subject; another wallet is rejected.

curl https://api.ignite.trade/v1/portfolio/0xYOUR_WALLET \
  -H "Authorization: Bearer $IGNITE_TOKEN"

curl -X POST https://api.ignite.trade/v1/orders \
  -H "Authorization: Bearer $IGNITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "market": "LITHO/USDT",
    "side": "buy",
    "type": "limit",
    "price": 8.70,
    "size": 1,
    "clientOrderId": "strategy-a-000001",
    "timeInForce": "GTC",
    "postOnly": false,
    "reduceOnly": false
  }'

Returns only orders belonging to the authenticated wallet, including open and terminal states.

curl https://api.ignite.trade/v1/orders \
  -H "Authorization: Bearer $IGNITE_TOKEN"

Only the authenticated owner can cancel a live order. Filled, rejected, expired, failed, or already-cancelled orders cannot be cancelled.

curl -X DELETE https://api.ignite.trade/v1/orders/ORDER_ID \
  -H "Authorization: Bearer $IGNITE_TOKEN"

Returns fills where the authenticated wallet was maker or taker. The optional limit is clamped to 1–500 and the optional market filter uses the published market symbol.

Responses and integration safety

Admin, custody-operator, RPC credentials, internal service routes, and automation-signer details are intentionally outside this public integration contract.