Auth for writes

Read endpoints are public. Globe heartbeats use per-node Ed25519 identity; privileged capacity-directory writes use an operator webhook secret.

Public node heartbeats

The GRID CLI creates a dedicated private key at ~/.grid/keys/mesh-heartbeat.key. It signs every location pulse with a timestamp and random nonce. The server derives the node ID from the public key, verifies the signature, and rejects replayed or stale messages atomically.

bash

# No shared globe secret is required.
GRID_GLOBE_LAT=37.7
GRID_GLOBE_LNG=-122.4
GRID_GLOBE_REGION=NA-W

grid init --name garage --class S
grid node

Operator write authentication

Mechanism	Example
Authorization Bearer	Authorization: Bearer <GRID_WEBHOOK_SECRET>
Custom header	X-Grid-Secret: <GRID_WEBHOOK_SECRET>

bash

export GRID_WEBHOOK_SECRET='…'   # never commit

curl -sS -X POST https://grid-compute.com/api/registry/computes \
  -H 'content-type: application/json' \
  -H "authorization: Bearer $GRID_WEBHOOK_SECRET" \
  -d @announce.json

Which routes need it

POST /api/mesh/ping — node signature, not bearer auth
POST /api/registry/computes
Other operator announce hooks as they ship

Name registration and entity applications use Cash App payment notes rather than the webhook secret.

Operator practice

Store the secret in ~/.grid/env (mode 600)
Never embed it in Mesh, websites, or mobile apps
Rotate the webhook secret for privileged compute writers together
Treat it as an ingress gate, not a user identity system

This docs site does not describe privileged internal tooling. If a response field would let an attacker harm operators or the ledger (private keys, raw dial endpoints, forensic payloads), it is not part of the public contract.