API

Public reads are JSON with open CORS. Writes need a wallet session (a signed message, never a transaction).

Method	Path	What	Access
POST	/api/looks	Fly to an address: { address, save? } → the pin, the place, the recent Sentinel-2 scenes or yesterday's VIIRS pass. Saving needs a session for that wallet.	30/min per IP
GET	/api/spots?limit=&before=	Saved spots, newest first, with their postcard counts.	public, CORS
GET	/api/spots/{n}	One spot with its postcards.	public, CORS
GET	/api/spots/{n}/mailbox	A spot's postcards, newest first.	public, CORS
PUT	/api/spots/{n}/composition	The owner's postcard design: { scene, zoom, colour, message }.	session
GET	/api/wallet/{address}	The spot a wallet saved, if any.	public, CORS
GET	/api/globe	Every saved pin, and the share of land cells with a holder.	public, CORS
GET	/api/coin	The coin's mint (empty before launch).	public, CORS
POST	/api/auth/nonce	Start sign-in: { address } → a message to sign.	20/min per IP
POST	/api/auth/verify	Finish sign-in: { address, message, signature } → session cookie.	20/min per IP
GET	/api/me	Your session, phase and saved spot.	session
POST	/api/auth/logout	End the session.	session
POST	/api/admin/check	Check the mailboxes now: { n? }.	admin token