Authentication

Wallet adapter requests are server-to-server only.

Standard headers

Authorization: Bearer {operator_wallet_api_secret}
X-Polynion-Request-Id: req_...
X-Polynion-Timestamp: 2026-06-18T00:00:00.000Z
Accept: application/json

For JSON mutations:

Content-Type: application/json

Optional signing

If signatureSecretEnvVar is configured, OpenPoly also sends:

X-Polynion-Signature: v1=...

Signature is built from:

{timestamp}.{raw_body}

Requirements

• validate bearer token
• log request ID for tracing
• keep secrets server-only
• return JSON only