Instance token & archive credits

Your instance has one token, not accounts. Loopback reads need no key; writes, and every read once the API is published past loopback, use the INSTANCE_TOKEN from secondlayer init. Archive restore and backfill are a separate card credit.

# Local read — no key
curl http://127.0.0.1:3800/v1/index/events?limit=5

# Write — instance token, from 127.0.0.1 too
curl -X POST http://127.0.0.1:3800/api/subgraphs/my-balances/reindex \
  -H "Authorization: Bearer $INSTANCE_TOKEN"

Writes are not loopback-exempt. Once the instance has a token, /api/subgraphs, /api/subscriptions, /api/node, and /status require it on every call, including from the same box. Reads are the opposite: on loopback a token you send is used if it matches and ignored if it doesn't — presenting a key never turns a working read into a 401.

What counts as loopback is how the API port is published, not who is calling. Compose hands the API its own publish spec as API_PUBLISH_ADDR (default 127.0.0.1:3800); outside a container it falls back to the listen host. Publish on any other address and every /v1 request needs the token — and an instance that binds past loopback with no token refuses to start.

The CLI, MCP, and SDK all read INSTANCE_TOKEN (SL_API_KEY is a legacy alias, and the canonical name wins when both are set). The SDK also takes it explicitly: new SecondLayer({ apiKey: process.env.INSTANCE_TOKEN }). Default baseUrl is http://127.0.0.1:3800 (SL_API_URL overrides).

Bootstrap, backfill, and reindex from the signed public archive draw credits per partition bundle fetched; verification is always free, no account needed. bootstrap and repair show the price, in dollars, against your balance in the same confirm prompt you already use, before anything is charged. Every partition arrives over a short-lived presigned URL and is digest-checked before a row is written. Your first six repair bundles each month are free. Packs are $10, $25, $50, or $100. The prepaid balance is the hard cap.

secondlayer credits buy --email you@example.com --pack 25
secondlayer credits balance

credits buy opens a one-time card checkout against archive.secondlayer.tools, with no account and no login.

Auto-refill is off until you set it: secondlayer credits refill --below 5 --pack 25.

A signing secret (whsec_…) is per-subscription and verifies an incoming webhook came from your instance (verifyWebhookSignature); see Subscriptions. Never in Authorization. Rotate with secondlayer subscriptions rotate-secret.