Developer

Build on the engine.

Everything the dashboard does goes through one public REST API: bots, discovery, proposals, Pine import, node bundles. Reads are open to anyone; writes are signed with your key.

API reference (live schema) →Task examples →

Your API key

One key authenticates both your self-hosted node and your own API calls. It is shown in full only once, at generation — store it somewhere safe and never share it.

Install command

Logged out

Quickstart

Three real calls against https://forkmyalpha.com/api/engine. sk_live_YOUR_KEY is a placeholder — generate a key above and substitute your own before running the authenticated ones.

1 · List the bots (GET, public)

# Public read — no key needed
curl -s https://forkmyalpha.com/api/engine/bots

2 · Track a discovery candidate (POST, key required)

# Authenticated write — replace sk_live_YOUR_KEY with a real key
curl -s -X POST https://forkmyalpha.com/api/engine/api/discovery/track \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ticker": "AMD"}'

3 · Compile a node bundle (POST, key required)

# Compile a VERIFIED genome into a self-host node bundle
curl -s -X POST https://forkmyalpha.com/api/engine/registry/bundle \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"genome_ref": "gme-tuned-histogram", "mode": "paper", "safety": {"daily_loss_cap_pct": 5}}'

The full endpoint list is rendered from the engine's live OpenAPI schema on the reference page; end-to-end flows live in the examples.

How auth works

No OAuth dance, no scopes to configure — one bearer key, four rules.

Reads are public

Every GET — leaderboard, bots, the discovery snapshot, the reality gap — is open. It is the same data the dashboard renders; no key needed.

Writes are key-signed

Mutations (POST/PUT/DELETE) require an Authorization: Bearer sk_live_... header. The platform stores only a hash of your key and validates against it; the raw key is never kept.

Keys are shown once

The full key appears exactly once, at generation. Put it in a secrets manager. If you lose it, generate a new one — there is no way to read it back.

Revocation is immediate

One active key per account: generating a new key revokes the old one, and a revoked key fails every authenticated call from that moment.

A few endpoints act on the platform's own baskets (proposal decisions, mark-applied) and additionally require the admin/owner role — they are marked in the examples.