Partner Regrant API

POST https://<pay-api-host>/v1/regrants
                                     # host is NOT this site — it is in your partner kit
X-Pay-Timestamp: 1789000000          # unix seconds; within 5 minutes of our clock
X-Pay-Signature: 0x…                 # personal_sign over the exact string below

{"source_lot_id": "01a0…",
 "items": [
   {"external_ref": "0xacme…:sep-airdrop:u-1",
    "account_ref": {"kind": "evm_address", "id": "0xAAA…"},
    "amount_micros": 10000000,                      # $10.00
    "expires_at": "2026-10-15T00:00:00Z"},
   {"external_ref": "0xacme…:sep-airdrop:u-2",
    "account_ref": {"kind": "evm_address", "id": "0xBBB…"},
    "amount_micros": 10000000}                      # omitted → inherits your own lot's
 ]}

pay-v2|POST|/v1/regrants|1789000000|9b74c9897bac770ffc029102a200c5de…

  pay-v2        a literal constant — not a name you pick, not a version
  POST          the method, uppercase
  /v1/regrants  the path, including the query string if there ever is one
  1789000000    the same unix seconds you send as X-Pay-Timestamp
  9b74c989…     sha256 of the request body, lowercase hex, 64 characters —
                the hash, never the body itself

Joined with "|": one line. No newlines, no spaces, no trailing separator.
Sign that line with EIP-191 personal_sign; send 0x + 65 bytes r||s||v.
v may be 0/1 or 27/28 — both recover, so send whatever your library gives you.
Hash the exact bytes you put on the wire — re-serialising the JSON before
hashing gives a different digest, and therefore a different signer.

// npm i viem        (Node 18+, ESM)
import { createHash } from "node:crypto";
import { privateKeyToAccount } from "viem/accounts";

const PAY_API = process.env.PAY_API_URL;        // from your partner kit, no trailing slash
const account = privateKeyToAccount(process.env.PARTNER_PRIVATE_KEY); // the seated wallet
const prefix = account.address.toLowerCase();

// Serialise ONCE. These exact bytes are hashed, signed and sent.
const body = JSON.stringify({
  source_lot_id: process.env.SOURCE_LOT_ID,
  items: [
    { external_ref: `${prefix}:sep-airdrop:u-1`,
      account_ref: { kind: "evm_address", id: "0xAAA…" },
      amount_micros: 10_000_000 },                // $10.00
  ],
});

const path = "/v1/regrants";
const ts = String(Math.floor(Date.now() / 1000));
const bodyHash = createHash("sha256").update(body).digest("hex");
const signature = await account.signMessage({   // EIP-191 personal_sign
  message: `pay-v2|POST|${path}|${ts}|${bodyHash}`,
});

const res = await fetch(PAY_API + path, {
  method: "POST",
  headers: { "Content-Type": "application/json",
             "X-Pay-Timestamp": ts, "X-Pay-Signature": signature },
  body,
});
const out = await res.json();
if (!res.ok) throw new Error(`${res.status} ${JSON.stringify(out)}`); // whole batch refused
for (const it of out.items) console.log(it.external_ref, it.outcome, it.reason ?? "");

# pip install eth-account requests
import hashlib, json, os, time
import requests
from eth_account import Account
from eth_account.messages import encode_defunct

PAY_API = os.environ["PAY_API_URL"]               # from your partner kit, no trailing slash
acct = Account.from_key(os.environ["PARTNER_PRIVATE_KEY"])  # the seated wallet
prefix = acct.address.lower()

# Serialise ONCE. These exact bytes are hashed, signed and sent.
body = json.dumps({
    "source_lot_id": os.environ["SOURCE_LOT_ID"],
    "items": [
        {"external_ref": f"{prefix}:sep-airdrop:u-1",
         "account_ref": {"kind": "evm_address", "id": "0xAAA…"},
         "amount_micros": 10_000_000},            # $10.00
    ],
}, separators=(",", ":")).encode()

path = "/v1/regrants"
ts = str(int(time.time()))
body_hash = hashlib.sha256(body).hexdigest()
signed = acct.sign_message(encode_defunct(text=f"pay-v2|POST|{path}|{ts}|{body_hash}"))
signature = "0x" + bytes(signed.signature).hex()  # EIP-191 personal_sign

res = requests.post(PAY_API + path, data=body, timeout=30, headers={
    "Content-Type": "application/json",
    "X-Pay-Timestamp": ts, "X-Pay-Signature": signature})
res.raise_for_status()                            # whole batch refused
for it in res.json()["items"]:
    print(it["external_ref"], it["outcome"], it.get("reason", ""))

Sign one request with the wallet you are logged in with here, then send it yourself. Nothing is sent from this page, and no private key is involved — the wallet signs and returns only the signature.

0xacme…:sep-airdrop:u-1
0xacme…:sep-airdrop:u-2
 └prefix┘ └─batch id─┘ └user┘        keep the whole thing under 120 characters

200 OK
{"granted_count": 2, "duplicate_count": 0, "rejected_count": 0,
 "granted_micros": 20000000,
 "items": [
   {"external_ref": "0xacme…:sep-airdrop:u-1", "outcome": "granted",
    "account_id": "01a0…", "account_created": true, "lot_id": "01a0…",
    "depth": 1, "amount_micros": 10000000,
    "expires_at": "2026-10-15T00:00:00Z"},
   {"external_ref": "0xacme…:sep-airdrop:u-2", "outcome": "granted",
    "account_id": "01a0…", "account_created": true, "lot_id": "01a0…",
    "depth": 1, "amount_micros": 10000000,
    "expires_at": "2026-12-31T00:00:00Z"}   # not specified, inherited from the lot
 ]}