# Authentication

Meridian uses EIP-712 signatures for authenticated API operations. Depending on the endpoint, the signature is supplied in the request body or through `X-Meridian-*` headers.

The Perpetuals API does not use bearer tokens or shared API keys.

| Scheme          | Request shape                 | Typical use                                         |
| --------------- | ----------------------------- | --------------------------------------------------- |
| Public          | No signature                  | Market and configuration data                       |
| Signed body     | `data` and `signature` fields | Orders, transfers, conversions, and account actions |
| EIP-712 headers | `X-Meridian-*` headers        | Authenticated reads                                 |

The endpoint schema specifies which scheme applies. Retrieve the EIP-712 domain and type definitions from `GET /v1/rpc/config`.

## Signed Request Bodies

Most authenticated `POST` endpoints accept an EIP-712 message and its signature:

```json
{
  "data": {
    "sender": "0xSIGNER_ADDRESS",
    "...": "ENDPOINT_SPECIFIC_FIELDS"
  },
  "signature": "0xEIP712_SIGNATURE"
}
```

Sign the exact type required by the endpoint. Common examples include:

| Operation                    | EIP-712 type                          |
| ---------------------------- | ------------------------------------- |
| Submit or simulate an order  | `TradeOrder`                          |
| Cancel orders                | `CancelOrder`                         |
| Initiate a withdrawal        | `InitiateWithdraw`                    |
| Convert quote tokens         | `ConvertToken`                        |
| Manage a linked signer       | The corresponding signer action type  |
| Activate or claim a referral | `EIP712Auth` with the required intent |

Some request bodies include fields in addition to the signed message. Follow the endpoint schema when constructing the outer body. For example, linking a signer also requires `signerSignature`.

## EIP-712 Header Authentication

Authenticated reads place an `EIP712Auth` signature in these headers:

| Header                 | Value                                        |
| ---------------------- | -------------------------------------------- |
| `X-Meridian-Auth`      | `EIP712Auth`                                 |
| `X-Meridian-Sender`    | Signing address                              |
| `X-Meridian-Signature` | EIP-712 signature                            |
| `X-Meridian-Intent`    | Integer identifying the authorized operation |
| `X-Meridian-SignedAt`  | Signature time in Unix seconds               |

For example, referral reads use intent `2` (`REFERRAL_READ`):

```bash
curl "$MERIDIAN_API_BASE/referral/summary" \
  -H "X-Meridian-Auth: EIP712Auth" \
  -H "X-Meridian-Sender: 0xSIGNER_ADDRESS" \
  -H "X-Meridian-Signature: 0xEIP712_SIGNATURE" \
  -H "X-Meridian-Intent: 2" \
  -H "X-Meridian-SignedAt: 1785811200"
```

The signed `EIP712Auth` message contains `sender`, `intent`, and `signedAt`. Use intent `0` for referral activation, `1` for referral claims, and `2` for referral reads. Activation and claims send the signature in the request body; referral summary and history reads use the headers above.

See [Message Signing](/developer-guides/trading-api/message-signing) for domain configuration, field encoding, signature timing, and linked-signer rules.