Aura has not launched on mainnet yet, so entries before launch describe the API
and contracts as they are being finalized. Once mainnet is live, this page
becomes the record of what changed and when.
APIDocs
Bearer tokens for programmatic clients
POST /v1/auth/session now accepts issueToken: true and returns the session
JWT in the response body. Bots no longer need to manage a cookie jar.Bearer sessions are exempt from CSRF, since the header cannot be attached by a
browser cross-origin. Cookie sessions still require x-csrf-token on mutating
requests.Bearer sessions do not slide. Cookie sessions refresh on use, bearer sessions do
not, so re-authenticate on a 401 rather than assuming the token is still good.See Authentication.Elevated rate limits for integrators
Added a third rate-limit tier above anonymous and signed-in. Wallets on the elevated allowlist get higher read and write ceilings, intended for market makers and data consumers whose usage is legitimately above the default.See Rate limits.The published API surface is now an allowlist
GET /openapi.json and the spec behind this documentation are filtered to the
endpoints intended for public use. Operator and app-internal families are
withheld.The filter is default-deny, so a new internal route is private unless it is
explicitly published. Nothing that was public became private.Documentation restructure
New pages:- Contracts, with deployed addresses and verification steps
- Security, covering on-chain controls and responsible disclosure
- Error codes, for decoding an on-chain revert
- Your first API call and Place your first order
- Realtime data, documenting the SSE stream and its replay semantics
- The Programs section, splitting creator, liquidity, referral, and dispute-voting rewards into their own pages
/markets/rewards-and-incentives now redirects to
Programs overview.