curl --request POST \
--url https://api.useselo.xyz/v1/authorizations \
--header 'Content-Type: application/json' \
--data '
{
"targetUrl": "https://api.example.com/v1/orders",
"method": "POST",
"project": "orders-api",
"contact": "dev@example.com"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
targetUrl: 'https://api.example.com/v1/orders',
method: 'POST',
project: 'orders-api',
contact: 'dev@example.com'
})
};
fetch('https://api.useselo.xyz/v1/authorizations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.useselo.xyz/v1/authorizations"
payload = {
"targetUrl": "https://api.example.com/v1/orders",
"method": "POST",
"project": "orders-api",
"contact": "dev@example.com"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"authorizationId": "auth_…",
"status": "PENDING",
"origin": "https://api.example.com",
"routePath": "/v1/orders",
"method": "POST",
"verificationUrl": "https://api.example.com/.well-known/selo-verification.txt",
"expectedContent": "selo-verification=<token>"
}Create an authorization
Start proving that you control a target. Selo returns a one-time token; serve it as a line in <origin>/.well-known/selo-verification.txt, then call the verify endpoint. The authorization covers exactly one origin, path and method. The challenge stays open for one hour. This call is free and contacts nothing: Selo only parses the URL here.
curl --request POST \
--url https://api.useselo.xyz/v1/authorizations \
--header 'Content-Type: application/json' \
--data '
{
"targetUrl": "https://api.example.com/v1/orders",
"method": "POST",
"project": "orders-api",
"contact": "dev@example.com"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
targetUrl: 'https://api.example.com/v1/orders',
method: 'POST',
project: 'orders-api',
contact: 'dev@example.com'
})
};
fetch('https://api.useselo.xyz/v1/authorizations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.useselo.xyz/v1/authorizations"
payload = {
"targetUrl": "https://api.example.com/v1/orders",
"method": "POST",
"project": "orders-api",
"contact": "dev@example.com"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"authorizationId": "auth_…",
"status": "PENDING",
"origin": "https://api.example.com",
"routePath": "/v1/orders",
"method": "POST",
"verificationUrl": "https://api.example.com/.well-known/selo-verification.txt",
"expectedContent": "selo-verification=<token>"
}Body
Absolute https URL of the paid route. The hostname must be a public name (no IP literal, no single-label name such as localhost, no name ending in .localhost, .local, .internal, .home.arpa or .lan), on the default port, with no user name or password. The authorization covers this exact origin and path.
2048HTTP method Selo uses to call the target.
GET, POST Project name, 1 to 80 characters after trimming. It appears in the private report.
1 - 80Contact for the target owner, 3 to 200 characters after trimming. Stored, not returned.
3 - 200Response
Authorization created in PENDING state.
A new authorization and the verification token to publish. The challenge stays open for one hour.
Authorization ID, auth_ plus 26 Crockford base32 characters.
PENDING: challenge issued, not yet verified. VERIFIED: Selo found the token and may test the target until expiresAt. EXPIRED: the challenge or the authorization lapsed. REVOKED: the authorization was withdrawn.
PENDING, VERIFIED, EXPIRED, REVOKED Origin of the target URL, for example https://api.example.com.
Path of the target URL, without query string.
HTTP method Selo uses to call the target.
GET, POST Where Selo looks for the token: <origin>/.well-known/selo-verification.txt.
The exact line to serve in the verification file: selo-verification= followed by a 43-character base64url token. Selo stores only the SHA-256 of the token.