CurlShip Authentication

generated: '2026-11-04'
method: searched
source:
- https://curlship.com/openapi.json
- https://curlship.com/llms.txt
docs: https://curlship.com/docs
summary: The OpenAPI declares no securitySchemes. The docs state "No CAPTCHA, no login, no approval queue" -- every endpoint is called anonymously. Payment on the x402 endpoints is carried by a signed PAYMENT-SIGNATURE header, and edits to an existing listing are authorized by an ownership proof (email confirmation link or a domain token), not by credentials.
schemes:
- type: none
  description: No API key, account or login. Rate limits are applied per IP (and per listing for edits).
  source: https://curlship.com/llms.txt
- type: apiKey
  in: header
  name: PAYMENT-SIGNATURE
  role: payment-authorization (x402 v2), not identity
  description: base64 JSON x402 v2 PaymentPayload -- the client's EIP-3009 TransferWithAuthorization signature, echoing the quote as `accepted`. Without it the endpoint answers 402 with a PAYMENT-REQUIRED quote.
  operations: [x402Submit, x402Feature]
  declared_in_spec: false
  note: Declared in the spec as a header parameter on these two operations, not as a securityScheme.
- type: ownership-proof
  description: 'createEditRequest takes proof "email" (a one-time confirmation link mailed to the registered address) or proof "domain" (a token published at /.well-known/curlship-verify.txt or a <meta name="curlship-verify"> tag on BOTH the listed and new site), confirmed via confirmEditRequest.'
  operations: [createEditRequest, confirmEditRequest, getEditRequest]
  source: https://curlship.com/llms.txt