Ed25519 session tokens

┌───────────┐                          ┌──────────┐
│   Agent   │                          │  Sly API │
└─────┬─────┘                          └────┬─────┘
      │                                     │
      │  POST /v1/agents/:id/challenge      │
      ├────────────────────────────────────▶│
      │                                     │
      │  { challenge, expiresIn: 60 }       │
      │◀────────────────────────────────────┤
      │                                     │
      │  sign(challenge, privateKey)        │
      │                                     │
      │  POST /v1/agents/:id/authenticate   │
      │  { challenge, signature }           │
      ├────────────────────────────────────▶│
      │                                     │
      │  { sessionToken: "sess_...",        │
      │    expiresIn: 3600 }                │
      │◀────────────────────────────────────┤
      │                                     │
      │  GET /v1/anything                   │
      │  Authorization: Bearer sess_...     │
      ├────────────────────────────────────▶│

curl -X POST https://sandbox.getsly.ai/v1/agents \
  -H "Authorization: Bearer pk_test_..." \
  -H "Content-Type: application/json" \
  -d '{
    "parent_account_id": "acc_...",
    "name": "Payables Bot",
    "kya_tier": 2,
    "generate_keypair": true
  }'

{
  "data": { "id": "agt_...", ... },
  "credentials": { "token": "agent_test_...", ... },
  "authKey": {
    "keyId": "auth_abcdef01_12345678",
    "publicKey": "<base64 Ed25519 public key>",
    "privateKey": "<base64 Ed25519 private key>",
    "algorithm": "ed25519",
    "warning": "SAVE THIS PRIVATE KEY NOW — it will never be shown again!"
  }
}

curl -X POST https://api.getsly.ai/v1/agents/$AGENT_ID/auth-keys \
  -H "Authorization: Bearer pk_test_..."

curl -X POST https://sandbox.getsly.ai/v1/agents/$AGENT_ID/challenge

{
  "challenge": "challenge_abcdef01_random...",
  "expiresIn": 60,
  "algorithm": "ed25519"
}

import * as ed25519 from '@noble/ed25519';

const message = new TextEncoder().encode(challenge);
const privateKey = Buffer.from(PRIVATE_KEY_BASE64, 'base64');
const signature = Buffer.from(
  await ed25519.signAsync(message, privateKey)
).toString('base64');

import base64
from nacl.signing import SigningKey

signing_key = SigningKey(base64.b64decode(PRIVATE_KEY_BASE64))
signed = signing_key.sign(challenge.encode('utf-8'))
signature_b64 = base64.b64encode(signed.signature).decode()

import (
    "crypto/ed25519"
    "encoding/base64"
)

priv, _ := base64.StdEncoding.DecodeString(privateKeyB64)
sig := ed25519.Sign(ed25519.PrivateKey(priv), []byte(challenge))
sigB64 := base64.StdEncoding.EncodeToString(sig)

curl -X POST https://sandbox.getsly.ai/v1/agents/$AGENT_ID/authenticate \
  -H "Content-Type: application/json" \
  -d '{
    "challenge": "challenge_abcdef01_random...",
    "signature": "<base64 Ed25519 signature>"
  }'

{
  "sessionToken": "sess_xyz789...",
  "expiresIn": 3600,
  "agentId": "agt_..."
}

curl -H "Authorization: Bearer sess_xyz789..." \
  https://sandbox.getsly.ai/v1/wallets

curl -X POST https://api.getsly.ai/v1/agents/$AGENT_ID/auth-keys/rotate \
  -H "Content-Type: application/json" \
  -d '{ "proof": "<base64 signature of rotate:$AGENT_ID>" }'

curl -X DELETE https://api.getsly.ai/v1/agents/$AGENT_ID/auth-keys \
  -H "Authorization: Bearer pk_test_..."

curl -N -H "Authorization: Bearer sess_xyz789..." \
  https://sandbox.getsly.ai/v1/agents/$AGENT_ID/connect

import * as ed25519 from '@noble/ed25519';

const API = 'https://sandbox.getsly.ai';
const AGENT_ID = 'agt_...';
const PRIVATE_KEY = Buffer.from(process.env.AGENT_PRIVATE_KEY!, 'base64');

async function authenticate(): Promise<string> {
  // 1. Challenge
  const chRes = await fetch(`${API}/v1/agents/${AGENT_ID}/challenge`, {
    method: 'POST',
  });
  const { challenge } = await chRes.json();

  // 2. Sign
  const sig = await ed25519.signAsync(
    new TextEncoder().encode(challenge),
    PRIVATE_KEY
  );
  const signature = Buffer.from(sig).toString('base64');

  // 3. Authenticate
  const authRes = await fetch(`${API}/v1/agents/${AGENT_ID}/authenticate`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ challenge, signature }),
  });
  const { sessionToken } = await authRes.json();
  return sessionToken;
}

// Use it
const token = await authenticate();
const wallets = await fetch(`${API}/v1/wallets`, {
  headers: { Authorization: `Bearer ${token}` },
}).then((r) => r.json());

import { Sly } from '@sly_ai/sdk';

const sly = new Sly({
  agentId: 'agt_...',
  privateKey: process.env.AGENT_PRIVATE_KEY!,
  autoReauth: true, // re-runs handshake on 401
});

const wallets = await sly.wallets.list();