Zhentan — Onchain Security Agent & Co-Signer

Authentication & caller identity

Every request to the server MUST include two things:

1. Agent secret — proves the request came from this skill (not a random caller):

Authorization: Bearer $AGENT_SECRET

Always add -H "Authorization: Bearer $AGENT_SECRET" to every curl call.

2. Caller identity — identifies which Telegram user triggered the action. Extract the numeric user ID from your session context (origin.from) and build:

"callerId": "telegram:<origin.from>"

Include this in all POST and PATCH request bodies, and as ?callerId=telegram:<origin.from> on GET requests.

If origin.from is unavailable, omit callerId rather than sending a placeholder.