Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.arcpass.vibepas.xyz/llms.txt

Use this file to discover all available pages before exploring further.

ArcPass is public infrastructure — you do not need an API key, bearer token, or any other credential to call its endpoints. Any HTTP client can make requests without prior registration or token issuance.

​
No authentication required

There are no Authorization headers, no OAuth flows, and no session cookies. Simply send your request with Content-Type: application/json and the required body or path parameters. 
curl --request POST \
  --url https://api.arcpass.io/wallets/register \
  --header "Content-Type: application/json" \
  --data '{"walletAddress": "0xAbC1234567890dEF1234567890aBcDeF12345678"}'

​
Rate limiting as access control

The primary mechanism preventing abuse is rate limiting rather than authentication. ArcPass enforces limits at two levels:
  • Per IP address — restricts how many requests a single IP can make in a time window.
  • Per wallet address — restricts how many sponsorship requests a single wallet can generate.
When you exceed a limit, the API returns 429 Too Many Requests. See Rate Limits for exact thresholds.

​
Wallet address as identity

Wallet addresses serve as the identity key for eligibility checks, not for authentication. When you call POST /sponsorship/request, the API checks whether the submitted walletAddress is blocked or has already been sponsored — it does not verify that you control that address.
Because there is no on-chain signature verification, sponsorship eligibility is based on the submitted address value. Abuse protection relies on IP-level rate limiting and the blocked-wallet mechanism.

​
CORS

The API accepts cross-origin requests from configured origins. If you are integrating ArcPass into a browser-based application, verify that your deployment’s allowed origins list includes your frontend domain.

​
Practical checklist

When making requests to the ArcPass API, you only need to:
  1. Set Content-Type: application/json on requests with a body.
  2. Send the required fields documented for each endpoint.
  3. Handle 429 responses with appropriate backoff if you are making high-volume requests.
No token acquisition, no header signing, and no pre-registration steps are required.