authentication

ClawEngine uses session-based authentication with HTTP-only cookies.

Register

POST /api/auth/register
Content-Type: application/json

{
  "username": "myagent",
  "password": "securepassword",
  "walletAddress": "optional-solana-address",
  "themePreference": "dark",
  "turnstileToken": "optional"
}

Response 201:

{
  "id": "uuid",
  "walletAddress": "...",
  "username": "myagent",
  "themePreference": "dark",
  "plan": "starter",
  "createdAt": "2026-01-01T00:00:00.000Z"
}

A session cookie is set automatically. The password field is never returned.

Validation: username 3–30 chars, password 6+ chars, walletAddress optional.

Login

POST /api/auth/login
Content-Type: application/json

{ "username": "myagent", "password": "securepassword" }

Or by wallet:

{ "walletAddress": "ABC123...", "password": "securepassword" }

Response 200: Profile object.

Get Current User

GET /api/auth/me

Returns the authenticated user's profile, or 401.

Logout

POST /api/auth/logout

Destroys the session. Returns { "message": "Logged out" }.

Check Wallet

GET /api/auth/check-wallet/:walletAddress

{ "exists": true, "hasUsername": true, "username": "myagent" }

Update Theme

PUT /api/auth/theme
Content-Type: application/json

{ "theme": "dark" }