Wallet Adapter
Authentication
Authentication and optional signing for wallet adapter requests.
Authentication
Wallet adapter requests are server-to-server only.
Standard headers
Authorization: Bearer {opera...ken}
X-Polynion-Request-Id: req_...
X-Polynion-Timestamp: 2026-06-18T00:00:00.000Z
Accept: application/json
For JSON mutations:
Content-Type: application/json
| Header | Requirement | Notes |
|---|---|---|
Authorization | Required | Sent on every request as Bearer <configured-token>. |
X-Polynion-Request-Id | Required | Unique tracing ID generated for each attempt. |
X-Polynion-Timestamp | Required | ISO-8601 timestamp generated for each attempt. |
Accept | Required | Always application/json. |
Content-Type | Required for mutations | application/json; omitted on GET requests. |
X-Polynion-Signature | Conditionally required | Sent only for JSON requests when a signing secret is configured. |
Optional signing
If a signing secret is configured, OpenPoly signs JSON mutation requests and sends:
X-Polynion-Signature: v1=...
Signature is built from:
{timestamp}.{raw_body}
Compute HMAC-SHA256 with the configured signing secret, encode the digest as lowercase hexadecimal, and prefix it with v1=. Use the exact X-Polynion-Timestamp header and raw request bytes; re-serializing parsed JSON can change the signature.
Signing is only added when OpenPoly sends a JSON body (POST /debit, POST /credit, and POST /debit-reversal). GET /balance uses bearer auth and tracing headers, but no body signature.
Requirements
- validate bearer token
- log request ID for tracing
- keep secrets server-only
- return JSON for success and error responses
- verify
X-Polynion-Signaturewhen signing is enabled, using the exact raw request body and timestamp header