example.secrets.toml

[evm]
# HTTP RPC URL for the orderbook chain. Drives continuous eth_getLogs fill
# polling and all read-only contract calls (single transport, no WebSocket).
rpc_url = "https://mainnet.base.org"
# Required when [wallet] is configured:
base_rpc_url = "https://mainnet.base.org"
ethereum_rpc_url = "https://mainnet.infura.io"

[broker]
mode = "sandbox"
type = "alpaca-broker-api"
api_key = "test_key"
api_secret = "test_secret"
account_id = "dddddddd-eeee-aaaa-dddd-beeeeeeeeeef"

# Wallet secrets — backend-specific credentials.
[wallet]
private_key = "0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

# For kind = "turnkey" (in config), use instead:
# [wallet]
# api_private_key = "hex-encoded-p256-api-private-key"

# Optional — REST API credentials for the Orders dashboard tab.
# Only needed when [rest_api] is configured in the config file.
# [rest_api]
# key_id = "your-key-id"
# key_secret = "your-key-secret"

# Required — issuance internal status API for the rebalancing freeze guard.
# Both base_url and api_key live here (issuance is not on the internal network
# yet). base_url is the issuance HTTP origin; api_key is the 32-byte secret
# issuance generates with `openssl rand -hex 32`. Write it here as hex
# (0x-prefix optional); the bot strips the prefix and sends the bare 64-char
# lowercase hex in the X-API-KEY header. Issuance authenticates by a raw string
# byte-compare (it does NOT hex-decode), so its ISSUER_API_KEY MUST hold that
# exact bare lowercase-hex string — not 0x-prefixed, not uppercase — or every
# request 401s.
[issuance]
base_url = "http://issuance.internal:8000"
api_key = "0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

# Optional — Telegram bot token for low-gas alerting.
# Only needed when [alerts] is configured in the config file.
# [alerts]
# bot_token = "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11"