Skip to main content
Sleuth Intel supports two authentication methods: wallet login for the browser terminal and API keys for programmatic access via the REST API or MCP server. Both methods are tied to the same account, and your access level is always governed by your current tier.

​
Wallet Login

Use wallet login when you are working directly in the Sleuth terminal at sleuthintel.io. There is no username or password — your wallet signature proves ownership. Supported wallets:
  • MetaMask (browser extension and mobile)
  • Phantom (Solana-native, EVM-compatible)
  • Base (Coinbase smart wallet)
  • Rabby (multi-chain desktop)
  • Rainbow (mobile-first Ethereum)
  • WalletConnect (scan-to-connect for any compatible wallet)
To connect:
1

Open the App

Navigate to sleuthintel.io in your browser.
2

Click Connect Wallet

Select your wallet provider from the modal. If you are using WalletConnect, scan the QR code with your mobile wallet.
3

Sign the Auth Message

Your wallet prompts you to sign a message. This signature authenticates your session — it does not initiate a transaction or cost gas.
Sleuth runs on Robinhood Chain (an Arbitrum L2). You do not need to switch networks or hold funds on Robinhood Chain just to authenticate. Your tier is determined by your subscription status or SLEUTH token balance.

​
API Keys

Use API keys when you are accessing Sleuth programmatically — from scripts, dashboards, backend services, or autonomous agents. All REST API and MCP server requests require a valid API key passed as a Bearer token.

​
Get an API Key

1

Open Account Settings

Click your wallet address in the top-right corner of the terminal, then navigate to Settings → API Keys.
2

Generate a New Key

Click Generate New Key, enter a descriptive label (e.g., my-agent-prod), and click Create.
3

Copy the Key

Copy the key immediately. For security reasons, Sleuth will not display it again after you close the modal. Store it in a secrets manager or environment variable.

​
Use the Key in Requests

Pass your API key in the Authorization header as a Bearer token on every request.

​
Tier Scoping

Your API key inherits the access level of the account that generated it. Higher tiers unlock access to additional endpoints: If you call an endpoint your tier does not cover, the API returns a 403 Forbidden response with a message indicating the required tier.
Agents and automated services that hold SLEUTH tokens or have an active subscription are automatically granted the corresponding tier on their API key — no manual upgrade required.

​
Rotate or Revoke a Key

To rotate a key, return to Settings → API Keys, click Revoke next to the key you want to retire, and generate a new one. Revocation is immediate — any in-flight requests using the old key will fail once it is revoked.

​
Security Best Practices

Keep your API keys secret. Never hard-code them in source files, commit them to version control, or share them in public channels. If a key is exposed, revoke it immediately from Settings → API Keys and generate a replacement.
Follow these practices to protect your keys:
  • Store keys in environment variables or a dedicated secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault, Doppler).
  • Use one key per environment (development, staging, production) so you can revoke a single key without impacting other deployments.
  • Set descriptive labels on each key so you can identify and rotate them quickly if needed.
  • For agents running in CI or cloud environments, inject the key at runtime rather than baking it into a container image or config file.