Home › Documentation › API reference
API reference
Authentication
Log in or register to receive a JSON Web Token, then send it on every authenticated request:
Authorization: <token>
Authorization: Bearer <token> // both accepted
Tokens expire (3 days by default). A missing or invalid token returns 401; a disabled account returns 403.
Account
| Method | Path | Purpose |
|---|---|---|
| GET | /api/auth/status | Server capabilities: signups open, invite required, Google availability |
| POST | /api/auth/register | Create an account (username, email, password) |
| POST | /api/auth/login | Exchange credentials for a token |
| POST | /api/auth/google | Sign up or sign in with a Google ID token |
| POST | /api/auth/google/link | Link Google to the account you are logged into |
| POST | /api/auth/google/unlink | Unlink Google (refused if it would lock you out) |
| GET | /api/auth/me | Your identity and counts |
| GET | /api/auth/profile | Account, wallet, aggregate stats and launch history |
| POST | /api/auth/password | Set or change your password |
| POST | /api/auth/main-wallet/generate | Mint a fresh funding wallet (refused if you have one, unless replace:true) |
| POST | /api/auth/main-wallet/export | Reveal your funding wallet's private key — needs your account password, throttled |
| POST | /api/auth/main-wallet/withdraw | Send SOL out — {to, amount} or {to, all:true}; password-checked, refused mid-campaign |
| POST | /api/auth/main-wallet | Import a funding wallet you already own (key stored encrypted) |
| GET | /api/auth/main-wallet | Its address and balance — never the key |
| DELETE | /api/auth/main-wallet | Forget the stored key (refused on a funded wallet without confirm:true) |
Launches
| Method | Path | Purpose |
|---|---|---|
| GET | /api/launch | Your launches, newest first |
| GET | /api/launch/:id | One launch plus its wallet addresses and balances |
| POST | /api/launch | Create a launch (multipart: metadata, config, image) |
| POST | /api/launch/:id/start | Fund, launch and bundle-buy. Returns immediately; progress streams over the socket |
| POST | /api/launch/:id/sell | Sell every wallet, then sweep |
| POST | /api/launch/:id/rebuy | Retry buys for a created token whose bundle never landed |
| POST | /api/launch/:id/sweep | Pull leftover SOL from this launch's wallets |
| POST | /api/launch/recover | Sweep every un-recovered wallet across all your launches |
| GET | /api/launch/preflight | Check RPC, wallet, IPFS and pump.fun. Spends nothing |
Campaigns
| Method | Path | Purpose |
|---|---|---|
| GET | /api/campaign/tokens | Your token queue, in launch order |
| POST | /api/campaign/tokens | Add a token to the queue |
| POST | /api/campaign/tokens/samples | Fill the queue with the 5 bundled sample tokens (skips ones you already have) |
| PUT | /api/campaign/tokens/:id | Edit a queued token |
| DELETE | /api/campaign/tokens/:id | Remove one |
| GET | /api/campaign | Campaign config and live state |
| PUT | /api/campaign | Update shared config |
| POST | /api/campaign/start | Launch the queue in sequence |
| POST | /api/campaign/stop | Halt after the token in flight |
| POST | /api/campaign/sell-stop | Panic: stop, sell everything, sweep it all home |
| POST | /api/campaign/reset-queue | Set queue statuses back to pending |
Live updates
Connect with socket.io, passing your token in the handshake:
io(location.origin, { auth: { token } })
An unauthenticated connection is refused. Events: launchUpdate for launch progress, campaign for queue progress. You receive only your own.
Errors
Errors are JSON: { "ok": false, "error": "..." }. 401 unauthenticated, 403 forbidden or disabled, 404 not yours or not found, 409 conflict (name or email taken), 429 rate-limited or at a per-user ceiling, 413 image too large.