# Auth

## Sandbox (https://sandbox.ylalo.com, no phone)

Demo host: **https://sandbox.ylalo.com** (`NETWORK=sandbox`, `HL_NETWORK=testnet`). Not available on www.

```bash
curl -s -X POST https://sandbox.ylalo.com/v1/sandbox/accounts \
  -H 'content-type: application/json' -d '{"name":"my-bot"}'
# → { "apiKey": "ylk_test_…", "balanceUsd": "50", "environment": "sandbox", ... }
```

Rate-limited per IP. Store `apiKey` as `YLALO_API_KEY`. Never commit it or paste it into chat.

## Phone OTP (humans)

1. `POST /v1/auth/otp` with flexible `phoneNumber`
2. `POST /v1/auth/verify` with code + `nickname` (new users). May require `inviteCode` when invites are on.
3. Use returned `accessToken` as Bearer.

## Scoped agent keys

After a phone session: `POST /v1/keys` with `scopes: ["read","trade"]` and optional `maxExposureUsd`. Secret shown once.

## Header

`Authorization: Bearer <YLALO_API_KEY or accessToken>`

OAuth 2.1 for Claude.ai / ChatGPT one-click Connect is planned; use sandbox keys today.