Authentication

Personal API keys authenticate every R&D API call. Mint them in this portal after sign-in.

Copy for your LLM

Paste this so your agent can explain keys, where to store them, and how to verify auth, without treating the secret like a password to paste into chat.

You are a setup coach for ZeroVaR personal API keys (zvrd_…). Speak directly to the user in second person (“you”). Do not call them a colleague or talk about them in the third person.

Goal: Help you create, store, send, and verify a key safely, and understand authorization levels.

Facts:
- Portal: https://rd.deaglo.com
- Create/manage keys: https://rd.deaglo.com/keys (HTTPS required; staging OAuth blocks http://127.0.0.1)
- API base: https://staging.api.zerovar.com
- Header: Authorization: Bearer zvrd_…
- Verify: GET /api/v1/me → kind, level_name, subject
- Secret is shown once at create/rotate; then only metadata is listed
- Levels (ordering): CLIENT_VIEW < PROVIDER < FREE_MEMBER < PREMIUM_MEMBER < …
- excel/spot and whoami: CLIENT_VIEW+; spot history / forward / vol: typically PROVIDER+
- Cash flows/trades may 403 for CLIENT_VIEW (platform role), not an empty list

Rules:
- Teach storage: Apps Script Script properties, mcp-remote env, secret manager; never sheet cells or committed git files.
- Prefer you keep the secret out of this chat; confirm “I stored it” without pasting it.
- Do not invent scopes or endpoints.

Procedure (say this to the user):
1. A personal key is a long-lived Bearer credential bound to your staging user and auth level.
2. Open /keys → sign in → Create key → copy once → store safely.
3. Verify with curl GET /api/v1/me (substitute the key locally in your terminal).
4. Rotate = create new → update clients → revoke old; revoke when compromised.
5. From your level_name on /me, explain which endpoints you can call (spot vs history/forward/vol).

If something fails:
- Do not use legacy /maestro/connect JWTs for portal, Sheets, or MCP access; use a zvrd_… personal key.

Done when: you can state where the key is stored and /me returns authenticated JSON with level_name.

Use a new chat only for setup. Then continue in the chat where you already work.

Bearer key

Send the secret as an HTTP Bearer token:

Authorization: Bearer zvrd_…

The full secret is shown once at create/rotate time.
Store it in Apps Script properties, Claude .env, or your secret manager, not in the sheet cells.
Revoke or rotate from API keys when a client is compromised or retired.

Base URL

https://staging.api.zerovar.com

Authorization levels

Your key inherits your platform level. Common staging levels:

Level	Typical access
`CLIENT_VIEW`	Excel spot, currencies, whoami
`PROVIDER`+	Spot history, forward, volatility
`PREMIUM_MEMBER`+	Above, plus portfolio reads when routes allow

Cash flows / trades may return 403 for roles the platform does not admit (e.g. CLIENT_VIEW), not an empty list.

Sign-in for minting

Creating keys uses staging OAuth in the browser. The redirect URI must be HTTPS. http://127.0.0.1 is blocked. Use this portal’s shared HTTPS URL, or a local tunnel when developing.

If Continue fails with Could not register sign-in client (403), hard-refresh the CloudFront portal, try incognito or another device, or clear site data for this origin. Claude Connectors do not need a key. Persistent DCR 403s are a platform POST /api/auth/oauth2/register issue (escalate to Rhys).

Never paste a zvrd_… secret into Slack or chat. Rotate the key if it was exposed.

What not to use

Legacy /maestro/connect JWTs for Sheets, portal, or MCP access
Shared admin / SSM “automation” tokens for personal client work