Skip to main content
SimpleFunctions has three auth flavors depending on the surface:
SurfaceAuthHeader
Landing public + agent readsOptional for basic readsAuthorization: Bearer sf_live_... only when using authenticated overlays or higher tiers
Thesis + portfolio + watch APIsSimpleFunctions API keyAuthorization: Bearer sf_live_...
Web terminal sessionsSupabase JWTAuthorization: Bearer eyJ...
Terminal data API (data.simplefunctions.dev)Data API keyAuthorization: Bearer sft_live_...
Kalshi exchangeBYOK private keyLocal-only (CLI), or AES-256-GCM encrypted upload (autopilot)
Polymarket exchangeBYOK walletLocal-only or wallet-connect on web terminal
MCPSimpleFunctions API keyAuthorization: Bearer sf_live_...

​
CLI login

sf login
Opens a browser. After authorization, the CLI receives a long-lived API key and writes it to ~/.config/simplefunctions/config.json.

​
Manual API key

Get one at simplefunctions.dev/dashboard/keys. Set: 
export SF_API_KEY="sf_live_..."
export SF_API_URL="https://simplefunctions.dev"

​
HTTP

curl -H "Authorization: Bearer $SF_API_KEY" \
  https://simplefunctions.dev/api/portfolio/state

​
User scoping

Authenticated account and portfolio routes are scoped to the authenticated user. Do not pass userId from the client for normal reads — server-side resolution always wins.

​
Secrets

The CLI and API never return raw exchange private keys. Key metadata may include presence, id suffixes, or created/rotated timestamps, but never secret material.

​
BYOK encryption (cloud autopilot)

sf portfolio enable does:
1

Read local Kalshi PEM

From your local ~/.config/simplefunctions/config.json or environment variable.
2

Encrypt client-side

AES-256-GCM with your SimpleFunctions account-derived key. The plain PEM never leaves the local process.
3

Upload ciphertext

POST /api/portfolio/secrets. Server stores ciphertext only.
4

Decrypt during ticks only

Decryption happens inside the cloud tick runner only for the active tick, then the key is erased from process memory.

​
See also

API keys

Scopes and rotation.

Portfolio autopilot

Cloud autopilot setup with BYOK.

Security

Encryption and audit guarantees.