Documentation

Testing the Protected Route

ChainGuard uses a demonstration protected API route /api/protected to verify the ownership of an API key locally, backed by the remote blockchain contract.

curl -X GET http://localhost:3000/api/protected \
  -H "Authorization: Bearer YOUR_RAW_API_KEY" \
  -H "X-Wallet-Address: 0xYOUR_WALLET_ADDRESS"

Important: Provide the raw API key created in your dashboard, NOT the "0x" hash structure. The backend intercepts your raw string, creates the SHA-256 hash using crypto, and asks Sepolia if that owner correctly owns the hash.

ChainGuard Overview

A secure, decentralized API key management dApp built on the Ethereum Sepolia Testnet. Generate cryptographic keys completely locally in your browser context, register their hashes on-chain, and verify ownership through blockchain-gated API routes.

Architecture

Browser (Web Crypto API)         Backend (Next.js)         Blockchain (Sepolia)
┌─────────────────────┐         ┌──────────────────┐         ┌─────────────────────┐
│ Generate 256-bit key│         │ /api/register    │         │ APIKeyRegistry.sol  │
│ SHA-256 hash locally│ ──────► │ Relayer pays gas │ ──────► │ registerKeyHash()   │
│ Show key ONCE       │         │ /api/protected   │         │ verifyOwner()       │
│                     │         │ Hash + verify    │ ◄────── │ revokeKey()         │
└─────────────────────┘         └──────────────────┘         └─────────────────────┘

Smart Contract Integration

Address: 0x950AACf33014e9924191f0deD6CEdbb515D347B2

registerKeyHash(bytes32, address)

Write operation. Registers a new SHA-256 hash to a particular ownership address.

revokeKey(bytes32, address)

Write operation. Permanently invalidates the API key hash forever. Action is irreversible.

verifyOwner(bytes32, address)

Read operation (Gasless). Confirms whether the provided hash maps to the supplied address.

Other API Endpoints

Register a Key Hash

curl -X POST http://localhost:3000/api/register \
  -H "Content-Type: application/json" \
  -d '{"keyHash": "0xYOUR_HASH", "owner": "0xYOUR_WALLET"}'

Check Database Status Manually

curl -X POST http://localhost:3000/api/verify \
  -H "Content-Type: application/json" \
  -d '{"keyHash": "0xYOUR_HASH", "owner": "0xYOUR_WALLET"}'

Trigger Revocation via Relayer

curl -X POST http://localhost:3000/api/revoke \
  -H "Content-Type: application/json" \
  -d '{"keyHash": "0xYOUR_HASH", "owner": "0xYOUR_WALLET"}'

Security Architecture

Raw API keys are generated solely within your specific browser session and are fundamentally invisible to our server.
We only commit irreversible SHA-256 hashes onto the Sepolia Ethereum Ledger.
All transaction (gas) fees are sponsored via our backend API relay architecture.
Data lookups checking mapping validity is a read-only unmetered gasless call.
Registered API keys permanently bind to a single Wallet ID entity mapping immutable ownership.