> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sleuthintel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication: Wallet Login and API Keys for Sleuth Intel

> Connect via wallet signature for the terminal UI or use API keys with Bearer auth for REST and MCP access — both methods are scoped to your tier.

Sleuth Intel supports two authentication methods: **wallet login** for the browser terminal and **API keys** for programmatic access via the REST API or MCP server. Both methods are tied to the same account, and your access level is always governed by your current tier.

## Wallet Login

Use wallet login when you are working directly in the Sleuth terminal at [sleuthintel.io](https://www.sleuthintel.io/feed). There is no username or password — your wallet signature proves ownership.

**Supported wallets:**

* MetaMask (browser extension and mobile)
* Phantom (Solana-native, EVM-compatible)
* Base (Coinbase smart wallet)
* Rabby (multi-chain desktop)
* Rainbow (mobile-first Ethereum)
* WalletConnect (scan-to-connect for any compatible wallet)

**To connect:**

<Steps>
  <Step title="Open the App">
    Navigate to [sleuthintel.io](https://www.sleuthintel.io/feed) in your browser.
  </Step>

  <Step title="Click Connect Wallet">
    Select your wallet provider from the modal. If you are using WalletConnect, scan the QR code with your mobile wallet.
  </Step>

  <Step title="Sign the Auth Message">
    Your wallet prompts you to sign a message. This signature authenticates your session — it does not initiate a transaction or cost gas.
  </Step>
</Steps>

<Note>
  Sleuth runs on Robinhood Chain (an Arbitrum L2). You do not need to switch networks or hold funds on Robinhood Chain just to authenticate. Your tier is determined by your subscription status or SLEUTH token balance.
</Note>

***

## API Keys

Use API keys when you are accessing Sleuth programmatically — from scripts, dashboards, backend services, or autonomous agents. All REST API and MCP server requests require a valid API key passed as a Bearer token.

### Get an API Key

<Steps>
  <Step title="Open Account Settings">
    Click your wallet address in the top-right corner of the terminal, then navigate to **Settings → API Keys**.
  </Step>

  <Step title="Generate a New Key">
    Click **Generate New Key**, enter a descriptive label (e.g., `my-agent-prod`), and click **Create**.
  </Step>

  <Step title="Copy the Key">
    Copy the key immediately. For security reasons, Sleuth will not display it again after you close the modal. Store it in a secrets manager or environment variable.
  </Step>
</Steps>

### Use the Key in Requests

Pass your API key in the `Authorization` header as a Bearer token on every request.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.sleuthintel.io/v1/feed \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.sleuthintel.io/v1/feed', {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  });

  const data = await response.json();
  ```
</CodeGroup>

### Tier Scoping

Your API key inherits the access level of the account that generated it. Higher tiers unlock access to additional endpoints:

| Tier   | API Access                                 |
| ------ | ------------------------------------------ |
| Free   | Limited endpoints (e.g., basic feed)       |
| Tier 2 | Partial endpoint access                    |
| Tier 3 | Full endpoint access                       |
| Tier 4 | Full endpoint access + highest rate limits |

If you call an endpoint your tier does not cover, the API returns a `403 Forbidden` response with a message indicating the required tier.

<Tip>
  Agents and automated services that hold SLEUTH tokens or have an active subscription are automatically granted the corresponding tier on their API key — no manual upgrade required.
</Tip>

### Rotate or Revoke a Key

To rotate a key, return to **Settings → API Keys**, click **Revoke** next to the key you want to retire, and generate a new one. Revocation is immediate — any in-flight requests using the old key will fail once it is revoked.

***

## Security Best Practices

<Warning>
  Keep your API keys secret. Never hard-code them in source files, commit them to version control, or share them in public channels. If a key is exposed, revoke it immediately from **Settings → API Keys** and generate a replacement.
</Warning>

Follow these practices to protect your keys:

* Store keys in environment variables or a dedicated secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault, Doppler).
* Use one key per environment (development, staging, production) so you can revoke a single key without impacting other deployments.
* Set descriptive labels on each key so you can identify and rotate them quickly if needed.
* For agents running in CI or cloud environments, inject the key at runtime rather than baking it into a container image or config file.