Bind method, path, body hash, receipt, locker, nonce, expiry, and ops.
Docs · HTTP
HTTP helpers
optionalchoose one helper
Helpers
Signing helpers.
Signed envelope helper implementations
The helpers differ only in runtime ergonomics. Shell, JavaScript, and Python all produce the same canonical envelope bytes and the same two HTTP headers: X-Nukez-Envelope and X-Nukez-Signature.
The signer must match the owner or payer recorded by the receipt.
Every protected endpoint checks the operation named in the envelope.
Browser warning. These helpers are command-line tools. Do not expose a private Solana keypair JSON in a browser. Browser apps should use a wallet adapter or a server-side signer.
Choose implementation
Select a helper implementation
Each option below has its own install path and code sample. The shared envelope rules above and the ops table below apply to all four.
mkdir -p nukez-http-helpers && cd nukez-http-helperscurl -fsSLO https://nukez.xyz/helpers/nukez_helpers.shcurl -fsSLO https://nukez.xyz/helpers/nukez_sign.mjschmod +x nukez_helpers.sh nukez_sign.mjs export BASE=https://api.nukez.xyzexport SOL_KEYPAIR=/path/to/solana-keypair.jsonsource ./nukez_helpers.sh BODY='{"receipt_id":"a107ea1ad3de433d","tags":[]}'signed_call POST /v1/storage/signed_provision '["locker:provision"]' "$BODY" | jq . signed_call GET "/v1/lockers/$LOCKER_ID/files" '["locker:list"]' | jq .
Code notes
The shell helper is the cleanest choice when the rest of your flow is already curl. It wraps signer output into request headers and leaves the payment, upload, and verification steps visible.
Use this path when you want a human-readable terminal flow. The shell helper delegates actual Ed25519 signing to the signer file next to it.
Shared reference
Operations cheat sheet
Every authenticated endpoint requires a specific ops array. Mismatched ops return 403 missing ops.
| Endpoint | Method | Helper call | Required op |
|---|---|---|---|
/v1/storage/signed_provision | POST | signed_call POST | locker:provision |
/v1/lockers/{locker_id}/files | POST | signed_call POST | locker:write |
/v1/lockers/{locker_id}/files/batch | POST | signed_call POST | locker:write |
/v1/lockers/{locker_id}/files | GET | signed_call GET | locker:list |
/v1/lockers/{locker_id}/files/{filename} | GET | signed_call GET | locker:read |
/v1/lockers/{locker_id}/files/{filename} | DELETE | signed_call DELETE | locker:write |
/v1/lockers/{locker_id}/record | GET | signed_call GET | locker:read |
/v1/storage/metadata/{locker_id} | GET | signed_call GET | locker:read |
/v1/storage/refresh | POST | signed_call POST | locker:refresh |
Shared fixes
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
422 missing headers | Request did not send both signed-envelope headers. | Use a helper path, or attach both headers from signer output. |
401 path mismatch | Signed a full URL instead of only the request path. | Use /v1/lockers/{locker_id}/files, not the full origin. |
401 body hash mismatch | Signed body bytes differ from the bytes sent by curl. | Pipe the same $BODY into the signer and curl -d. |
403 missing ops | The envelope has the wrong operation for the endpoint. | Use the ops cheat sheet above. |