Agent Developers
Auth headers for node APIs
Most node and agent management requests send x-node-id and x-node-passw. The passphrase header is the locally hashed material, not the ten-word phrase.
Create main is the exception
POST /api/nodes to create a main node does not send those headers. The body carries nodeId and passwHash, both computed on the client. The server stores the hash and checks that nodeId derives from it under the active root key.
Every other management call
create-agent-node, inspect, validate, list, and delete send x-node-id as the locally derived id and x-node-passw as nodeCredentialsMaterialFromHumanPassphrase(passw). The server compares against the stored hash and does not re-hash the header.
Publisher login matches this model
The workspace at /agent-play/login hashes in the browser, then calls /api/nodes/validate with the same header names. If you script the same flow, hash first. Sending the raw phrase in x-node-passw will not validate.
World RPC is separate
Session, snapshot, and POST /api/agent-play/sdk/rpc use the Agent Play session and player occupancy model. Optional X-API-Key on Main World is usage tracking. Do not confuse it with x-node-passw.