<!-- Markdown copy of https://insumermodel.com/developers/quickstart/ for agents. -->

> Get a free API key and make your first signed wallet auth call in five minutes: curl examples, response shapes and offline signature checks.
>
> Page: https://insumermodel.com/developers/quickstart/ · API: https://api.insumermodel.com · OpenAPI: https://insumermodel.com/openapi.json · Index for agents: https://insumermodel.com/llms.txt

[Developers](https://insumermodel.com/developers/) > Wallet Auth API Quickstart

# Wallet Auth API Quickstart

Wallet Auth reads what a wallet holds across 37 blockchains and returns a signed attestation. Boolean result, ECDSA-signed, no balance exposed.

Read on-chain conditions without running blockchain infrastructure or exposing wallet balances.

Source

Blockchain

Engine

InsumerAPI

Output

ECDSA-signed attestation

Consumer

Your app

Supports 37 chains through a unified condition format: 31 EVM chains plus Solana, XRPL, Bitcoin, Tron, Stellar and Sui.

## Get your API key

Free tier: 100 requests a day, 10 verification credits. One key per email, no credit card. Agents on EVM: pay with USDC and skip the email (see the wallet-paid path below).

Or via curl:

```bash
curl -X POST https://api.insumermodel.com/v1/keys/create \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",
    "appName": "My App",
    "tier": "free"
  }'
```

```json
{
  "success": true,
  "key": "insr_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
  "name": "My App",
  "tier": "free",
  "dailyLimit": 100,
  "apiKeyCredits": 10
}
```

Save the `key` value. It is shown once and cannot be retrieved later.

### Or for agents (wallet-paid)

Send 5+ USDC on Base to `0xee432065474D2C852700f74e3fD81e2Bcc16a3D4`, sign the payment with the same wallet, then POST the transaction hash and the signature. No email. The sender wallet becomes the key's identity, and an Insumer Access pass is minted to the same wallet so it can authenticate via wallet signature (see [Wallet Auth](https://insumermodel.com/developers/api-reference/#auth) below).

```bash
curl -X POST https://api.insumermodel.com/v1/keys/buy \
  -H "Content-Type: application/json" \
  -d '{
    "txHash": "0x...",
    "chainId": 8453,
    "amount": 5,
    "appName": "my-agent",
    "senderSignature": "0x..."
  }'
```

`senderSignature` proves you control the wallet that paid: that wallet signs this exact text with `personal_sign` (five lines joined by `\n`, no trailing newline; the transaction hash in lowercase). Send the request without it and the 400 response carries the exact text to sign.

Text to sign:

```
api.insumermodel.com
Confirm the wallet that sent this payment.
Purpose: key purchase
Chain: eip155:8453
Transaction: 0x<lowercase tx hash>
```

Volume rates: $5–$99 = 25 credits/$1, $100–$499 = 33 credits/$1, $500+ = 50 credits/$1. USDC only, on Ethereum, Base, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche or Solana (Solana wallets sign with `signMessage` and use `Chain: solana`). Non-EVM senders use `X-API-Key` auth; the Insumer Access pass mint happens on EVM purchases only.

## Your first attestation

Check if a wallet holds at least 1 USDC on Base. POST `/v1/attest`

Costs 1 credit ($0.04).

```bash
curl -X POST https://api.insumermodel.com/v1/attest \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{
    "wallet": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045",
    "conditions": [{
      "type": "token_balance",
      "contractAddress": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "chainId": 8453,
      "threshold": "1",
      "label": "USDC >= 1"
    }]
  }'

# wallet: vitalik.eth
# contractAddress: USDC on Base (chainId 8453, 6 decimals)
```

Agents on EVM who bought their key via `/v1/keys/buy` can replace `X-API-Key` with `Authorization: Wallet <envelope>` instead. The envelope is base64 JSON containing a [SIWE](https://eips.ethereum.org/EIPS/eip-4361) message scoped to `api.insumermodel.com` plus an EIP-191 signature. Drop-in middleware that handles the construction: [`@skyemeta/access`](https://www.npmjs.com/package/@skyemeta/access) on npm.

## The response

200 OK:

```json
{
  "ok": true,
  "data": {
    "attestation": {
      "id": "ATST-E365DB7F2A9C0481",
      "pass": true,
      "results": [
        {
          "condition": 0,
          "label": "USDC >= 1",
          "type": "token_balance",
          "chainId": 8453,
          "met": true,
          "evaluatedCondition": {
            "type": "token_balance",
            "chainId": 8453,
            "contractAddress": "0x8335...2913",
            "operator": "gte",
            "threshold": "1"
          },
          "conditionHash": "0x448ddd3e...",
          "blockNumber": "0x1772dde",
          "blockTimestamp": "2026-03-06T12:00:00.000Z"
        }
      ],
      "passCount": 1,
      "failCount": 0,
      "attestedAt": "2026-03-06T12:00:01.000Z",
      "expiresAt": "2026-03-06T12:30:01.000Z"
    },
    "sig": "rHObYHqV...",
    "kid": "insumer-attest-v2",
    "pqSig": "...",
    "pqKid": "insumer-attest-pq1"
  },
  "meta": {
    "creditsRemaining": 9,
    "creditsCharged": 1,
    "version": "1.0",
    "timestamp": "2026-03-06T12:00:01.000Z"
  }
}
```

`pass: true`: wallet meets all conditions

`pass: false`: one or more conditions failed

**sig**: ECDSA P-256 signature over the preimage the `kid` selects (v2: the domain tag plus canonical JSON of `{v:2, id, pass, results, attestedAt}`; v1: the bare JSON of those four fields), verify offline with `insumer-verify`

**kid**: identifies the signing key; fetch the public key from `/.well-known/jwks.json`

**pqSig** / **pqKid**: post-quantum signature (ML-DSA-65) beside `sig`, resolved from the same JWKS by `pqKid`; `insumer-verify` 1.8.1 and later reports it as a separate verdict. Verify all of it with `insumer-verify`, on npm or PyPI.

Attestations expire after 30 minutes (`expiresAt`) to prevent replay. The JWKS endpoint is cacheable (24h `max-age`); keys rotate rarely.

## Run it end-to-end

Copy-paste this into a file, set your API key, and run it. Makes the attestation request and verifies the signature in one script.

```javascript
// npm install insumer-verify axios
import axios from "axios";
import { verifyAttestation } from "insumer-verify";

const res = await axios.post(
  "https://api.insumermodel.com/v1/attest",
  {
    wallet: "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045",
    conditions: [{
      type: "token_balance",
      contractAddress: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      chainId: 8453,
      threshold: "1"  // decimal string (v2 keys reject a JSON number with 400)
    }]
  },
  { headers: { "X-API-Key": process.env.INSUMER_API_KEY } }
);

const verified = await verifyAttestation(res.data, {
  jwksUrl: "https://insumermodel.com/.well-known/jwks.json"
});

console.log("Valid:", verified.valid); // true
```

Minimal example for your README:

```javascript
const res = await axios.post(
  "https://api.insumermodel.com/v1/attest",
  {
    wallet: "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045",
    conditions: [{
      type: "token_balance",
      contractAddress: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      chainId: 8453,
      threshold: "1"  // decimal string (v2 keys reject a JSON number with 400)
    }]
  },
  { headers: { "X-API-Key": process.env.INSUMER_API_KEY } }
);

console.log(res.data.data.attestation.pass);
```

## Verify the signature offline

The `insumer-verify` npm package checks the ECDSA signature, condition hashes, expiry, pass/fail consistency, and the post-quantum signature in one call.

```javascript
// npm install insumer-verify
import { verifyAttestation } from "insumer-verify";

// Pass the full API response envelope, not response.data
const response = await res.json();
const result = await verifyAttestation(response, {
  jwksUrl: "https://insumermodel.com/.well-known/jwks.json"
});

console.log(result.valid); // true
```

## Next steps

#### Verification

All condition types, Merkle proofs, Wallet Auth JWTs, and the full POST /v1/attest reference.

[Verification](https://insumermodel.com/developers/verification/)

#### Trust Profiles

Signed fact profiles across stablecoins, governance, NFTs, staking, institutional stablecoins, tokenized treasuries, stablecoin deposits, wrapped bitcoin, and names.

[Trust Profiles](https://insumermodel.com/developers/trust/)

#### Compliance

EAS attestation templates for Coinbase Verified Account, Gitcoin Passport, and custom schemas.

[Compliance](https://insumermodel.com/developers/compliance/)

#### Commerce

Token-gated discounts with ACP and UCP endpoints for merchant and consumer flows.

[Commerce](https://insumermodel.com/developers/commerce/)

#### API Reference

The core endpoints, authentication, error codes, rate limits, and credit pricing.

[API Reference](https://insumermodel.com/developers/api-reference/)

[← Back to Developers Hub](https://insumermodel.com/developers/) [Next: Verification →](https://insumermodel.com/developers/verification/)