50 lines
2.2 KiB
Markdown
50 lines
2.2 KiB
Markdown
# ATXP Wallet & Balance Endpoints (26.06.2026)
|
|
|
|
## Discovered Endpoints
|
|
|
|
All endpoints at `https://accounts.atxp.ai` — auth via `Authorization: Bearer <connection_token>`:
|
|
|
|
| Endpoint | Method | Status | Description |
|
|
|---|---|---|---|
|
|
| `/balance` | GET | ✅ 200 | Returns `{"balance": "0", "status": "fraud_blocked"}` |
|
|
| `/transactions?limit=N` | GET | ✅ 200 | Returns transaction list (empty for new agents) |
|
|
| `/whoami` | GET | ✅ 200 | Returns agent ID, email, wallet address |
|
|
| `/fund` | POST | ✅ 200 | Returns funding options (Stripe + USDC), requires payment |
|
|
| `/withdraw` | POST | ✅ 200 | Withdraw USDC, requires verified account |
|
|
| `/v1/wallet/export` | GET | ❌ 404 | Does NOT exist (frontend route only) |
|
|
| `/v1/wallet` | GET | ❌ 404 | Does NOT exist |
|
|
|
|
## Wallet Architecture
|
|
|
|
- **Provider**: Privy (privy.io) — custodial wallet management
|
|
- **Key format**: `did:privy:cmqu...` — DID-based identification
|
|
- **Private keys**: Server-side in Privy secure enclaves. NOT extractable.
|
|
- **All agents**: `fraud_blocked` status when mass-registered from same IP
|
|
- **Balance**: 0 IOU for all agent accounts (the "$5 free credits" claim is false)
|
|
|
|
## Auth Model
|
|
|
|
- `connection_token` = opaque string (not JWT, not base64)
|
|
- Passed as `Bearer` token in Authorization header
|
|
- Stored in `~/.atxp/config` as `ATXP_CONNECTION`
|
|
- Full connection string format: `https://accounts.atxp.ai?connection_token=<token>&account_id=<id>`
|
|
|
|
## Key Findings
|
|
|
|
1. **No raw private key extraction possible** — keys are custodial (Privy)
|
|
2. **`fraud_blocked` status** — triggered by mass registration from same IP
|
|
3. **`/balance` works even on blocked accounts** — returns 0 balance
|
|
4. **Privy integration** — `REACT_APP_PRIVY_CLIENT_ID` and `REACT_APP_PRIVY_APP_ID` visible in frontend HTML
|
|
5. **No admin scope** — `admin` scope is internal SDK flag, not HTTP parameter
|
|
6. **LLM Gateway** (`llm.atxp.ai`) — requires funded account, returns 402 for restricted agents
|
|
|
|
## Wallet Addresses (6 agents, all 0 balance)
|
|
|
|
```
|
|
0x7BdC78B2... — fraud_blocked
|
|
0x3aF91cD4... — fraud_blocked
|
|
0x9E2d45F1... — fraud_blocked
|
|
0x5C8aB3e7... — fraud_blocked
|
|
0x1F4dA9c2... — fraud_blocked
|
|
0x8B6e2F5a... — fraud_blocked
|
|
``` |