Authentication

Read-only endpoints are open. Paid analysis is settled one of three ways: from a funded account balance, through the x402 payment protocol, or — for quick experiments — the CLI's free tier.

Account balance billing

The web app and dashboard run on a prepaid USD balance. You sign in (email code, Google, or wallet signature), top up your balance, and each analysis is debited at a fixed price:

Top-ups are processed via OxaPay (crypto) or Stripe (card). Manage your balance from the dashboard. See Pricing for details.

x402 payment flow

For programmatic, account-less payments, CSDS supports x402 — pay per call in USDC on Base, no account needed (available when enabled on the deployment). The flow is:

1. Send the request with no auth.
2. Receive 402 Payment Required with an x402 block (the amount and pay_to).
3. Send that USDC amount on Base to pay_to from any wallet.
4. Retry the request with the transaction hash in the X-PAYMENT header.
5. The API verifies the transfer on-chain and returns the result.

A 402 body looks like this:

{
  "code": "payment_required",
  "x402": {
    "network": "base-mainnet",
    "asset": "USDC",
    "amount": "0.10",
    "amount_units": "100000",
    "pay_to": "0xRecipient…"
  }
}

Each payment transaction is single-use. This is a transfer-and-verify flow (not EIP-3009), so send the USDC with any wallet — see the x402 guide and payment troubleshooting.

API keys

API keys are how you call the API programmatically. Each key belongs to your account, and every call is billed against your account balance — just like the web app.

1. Create a key from your dashboard. It's shown once — store it securely.
2. Send it on every request to a /api/v1/* endpoint, using either header:

Authorization: Bearer csds_live_…
# or
X-API-Key: csds_live_…

Each call debits your balance at the listed price. A missing or invalid key returns 401; an empty balance returns 402. Revoke a key anytime from the dashboard.

CLI free tier

The csds CLI grants 3 free lifetime quick checks to unauthenticated users, tracked locally. Standard reports and deep dives always require funding. Configure a key with csds config set api-key … (or the CSDS_API_KEY env var). See the CLI reference.

Next