String Technology Inc · Authentication Profile

String Technology Inc Authentication

Authentication

String uses two authentication layers: (1) API-key authentication for server-to-server and game-to-API calls via an X-Api-Key header, with two key classes — public keys (authenticate a game connecting to the String API) and secret keys (manage an organization programmatically); and (2) Web3 wallet-signature login for players (an EIP-4361 / Sign-In-With-Ethereum style challenge-response), where RequestToSign issues a nonce payload the player's wallet signs, and the signed payload is verified to establish an authenticated session with refreshable auth cookies/tokens. Derived by hand from the docs because no machine-readable OpenAPI is publicly retrievable.

String Technology Inc secures its APIs with apiKey, walletSignature, and session across 4 declared security schemes, as derived from its OpenAPI definitions.

CompanyPaymentsWeb3GamingFiat On-RampCryptocurrencyNFTMerchant of RecordDeveloper Tools

Methods: apiKey, walletSignature, session Schemes: 4 OAuth flows: API key in: header

Security Schemes

PublicApiKey apiKey

· in: header ()

SecretApiKey apiKey

· in: header ()

WalletSignatureLogin walletSignature

MemberLogin session

Source

Authentication Profile

generated: '2026-07-21'
method: searched
source: https://docs.string.xyz/docs/basic-auth
docs:
- https://docs.string.xyz/docs/basic-auth
- https://docs.string.xyz/docs/integrated-auth
- https://docs.string.xyz/docs/getting-started
description: >-
  String uses two authentication layers: (1) API-key authentication for
  server-to-server and game-to-API calls via an X-Api-Key header, with two key
  classes — public keys (authenticate a game connecting to the String API) and
  secret keys (manage an organization programmatically); and (2) Web3
  wallet-signature login for players (an EIP-4361 / Sign-In-With-Ethereum style
  challenge-response), where RequestToSign issues a nonce payload the player's
  wallet signs, and the signed payload is verified to establish an
  authenticated session with refreshable auth cookies/tokens. Derived by hand
  from the docs because no machine-readable OpenAPI is publicly retrievable.
summary:
  types: [apiKey, walletSignature, session]
  api_key_in: [header]
  api_key_header: X-Api-Key
schemes:
- name: PublicApiKey
  type: apiKey
  in: header
  parameter_name: X-Api-Key
  key_class: public
  usage: Authenticates a game/client connecting to the String API. Safe for game-side use.
  source: https://docs.string.xyz/docs/getting-started
- name: SecretApiKey
  type: apiKey
  in: header
  parameter_name: X-Api-Key
  key_class: secret
  usage: Programmatic organization management. Must never be exposed in client-side code or public repos.
  source: https://docs.string.xyz/docs/getting-started
- name: WalletSignatureLogin
  type: walletSignature
  standard: EIP-4361 (Sign-In With Ethereum, challenge-response)
  flow:
    request_nonce: GET /login (RequestToSign) — returns a nonce payload for a given wallet address
    sign_and_verify: POST /login/sign — submit the signed noncePayload; String verifies the signature to authenticate the player
    refresh: POST /login/refresh — refresh the session token
    logout: POST /login/logout — invalidate the auth cookies
  source: https://docs.string.xyz/reference/get_login
- name: MemberLogin
  type: session
  flow:
    login: POST /login — email/password login for organization members (dashboard)
    refresh: POST /login/refresh
    logout: POST /login/logout
  source: https://docs.string.xyz/reference/post_login