Email+password signup; mints a session credential.
POST/v1/auth/signup
Creates an account with entitlement mask 7 (no APITrading), stores the password (argon2id), and mints a session credential. session_token is a standard <prefix>.<suffix> bearer, returned exactly once, expiring after 7 days.
On faucet-enabled venues (dev/staging) the signup credit is sequenced asynchronously; faucet_uusdc echoes the amount and is omitted when the faucet is off.
Rate limit: 10 signups / 5 minutes per client IP.
No authentication is required for this endpoint.
Request
Responses
- 200
- 400
- 409
- 429
- 500
Account created and session minted. data.session_token is the only place the session bearer is ever returned.
Request was malformed or failed validation. The error.code field carries the
machine-readable reason; common values include invalid_request, invalid_json,
invalid_order_id, invalid_instrument_id, invalid_credential_id,
invalid_resolution, and operation-specific codes documented per endpoint.
The request conflicts with existing state. The error.code field carries the machine-readable reason (e.g. email_taken on signup).
Too many attempts inside the fixed rate-limit window (10 attempts / 5 minutes per key). Retry in a few minutes.
Unexpected server error. Includes a correlation_id; report it when filing a bug.