Auth for writes

Read endpoints are public. Write endpoints that affect the mesh or capacity directory require a shared webhook secret configured on the operator machine and on the registry Worker.

How to authenticate

Mechanism	Example
Authorization Bearer	Authorization: Bearer <GRID_WEBHOOK_SECRET>
Custom header	X-Grid-Secret: <GRID_WEBHOOK_SECRET>

bash

export GRID_WEBHOOK_SECRET='…'   # never commit

curl -sS -X POST https://grid-compute.com/api/mesh/ping \
  -H 'content-type: application/json' \
  -H "authorization: Bearer $GRID_WEBHOOK_SECRET" \
  -d '{"nodeId":"node_demo","lat":37.7,"lng":-122.4,"class":"S"}'

Which routes need it

POST /api/mesh/ping
POST /api/registry/computes
Other operator announce hooks as they ship

Name registration and entity applications use Cash App payment notes rather than the webhook secret.

Operator practice

Store the secret in ~/.grid/env (mode 600)
Never embed it in Mesh, websites, or mobile apps
Rotate by updating the Worker secret and all nodes together
Treat it as an ingress gate, not a user identity system

This docs site does not describe privileged internal tooling. If a response field would let an attacker harm operators or the ledger (private keys, raw dial endpoints, forensic payloads), it is not part of the public contract.