Agent Setup

Python (solders + requests)

import json, base64, requests
from solders.keypair import Keypair

API = "https://us-west-01-firestarter.pipenetwork.com"
kp = Keypair.from_bytes(bytes(json.load(open("keypair.json"))))
wallet = str(kp.pubkey())

# Challenge → Sign → Verify
r = requests.post(f"{API}/auth/siws/challenge",
    json={"wallet_public_key": wallet})
c = r.json()
sig = kp.sign_message(c["message"].encode())
sig_b64 = base64.b64encode(bytes(sig)).decode()

tokens = requests.post(f"{API}/auth/siws/verify", json={
    "wallet_public_key": wallet,
    "nonce": c["nonce"],
    "message": c["message"],
    "signature_b64": sig_b64,
}).json()

TOKEN = tokens["access_token"]
CSRF  = tokens["csrf_token"]
print("Authenticated!")

Install: pip install solders requests

curl + jq

# Create S3 key (save the secret — shown only once!)
curl -s -X POST "https://us-west-01-firestarter.pipenetwork.com/api/s3/keys" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-CSRF-Token: $CSRF" \
  -H "Content-Type: application/json" \
  -d '{}' | tee pipe-s3-key.json

# Extract into env vars
export AWS_ACCESS_KEY_ID=$(jq -r .access_key_id pipe-s3-key.json)
export AWS_SECRET_ACCESS_KEY=$(jq -r .secret_access_key pipe-s3-key.json)
export AWS_ENDPOINT_URL=$(jq -r .endpoint pipe-s3-key.json)
export AWS_DEFAULT_REGION=$(jq -r .region pipe-s3-key.json)
export PIPE_S3_BUCKET=$(jq -r .bucket_name pipe-s3-key.json)

Python

# After authentication (TOKEN and CSRF from step 1)
import requests

headers = {
    "Authorization": f"Bearer {TOKEN}",
    "X-CSRF-Token": CSRF,
    "Content-Type": "application/json",
}
key = requests.post(f"{API}/api/s3/keys", headers=headers, json={}).json()

# Save immediately — secret_access_key is shown only once
print("AWS_ACCESS_KEY_ID=" + key["access_key_id"])
print("AWS_SECRET_ACCESS_KEY=" + key["secret_access_key"])
print("AWS_ENDPOINT_URL=" + key["endpoint"])
print("AWS_DEFAULT_REGION=" + key["region"])
print("PIPE_S3_BUCKET=" + key["bucket_name"])

Python — robust API client

import time, requests

def refresh_tokens(api, refresh_token):
    """Exchange a refresh token for a new access + CSRF token."""
    r = requests.post(f"{api}/auth/refresh", json={
        "refresh_token": refresh_token,
    })
    r.raise_for_status()
    data = r.json()
    return data["access_token"], data.get("csrf_token", "")

def api_call(api, method, path, token, csrf="", **kwargs):
    """Make an API call with automatic 401 refresh and 429 backoff."""
    headers = {"Authorization": f"Bearer {token}"}
    if method.upper() != "GET":
        headers["X-CSRF-Token"] = csrf
        headers["Content-Type"] = "application/json"
    for attempt in range(3):
        r = requests.request(method, f"{api}{path}", headers=headers, **kwargs)
        if r.status_code == 401:
            # Token expired — caller should refresh and retry
            raise TokenExpiredError()
        if r.status_code == 429:
            wait = int(r.headers.get("Retry-After", 2 ** attempt))
            print(f"Rate limited, waiting {wait}s...")
            time.sleep(wait)
            continue
        if r.status_code == 403 and "csrf" in r.text.lower():
            raise CSRFError("CSRF token invalid — re-authenticate")
        r.raise_for_status()
        return r.json()
    raise Exception("Max retries exceeded")

class TokenExpiredError(Exception): pass
class CSRFError(Exception): pass

Node.js — robust API client

async function apiCall(api, method, path, token, csrf = "") {
  const headers = { "Authorization": `Bearer ${token}` };
  if (method !== "GET") {
    headers["X-CSRF-Token"] = csrf;
    headers["Content-Type"] = "application/json";
  }
  for (let attempt = 0; attempt < 3; attempt++) {
    const resp = await fetch(`${api}${path}`, { method, headers });
    if (resp.status === 401) throw new Error("TOKEN_EXPIRED");
    if (resp.status === 429) {
      const wait = Number(resp.headers.get("Retry-After")) || 2 ** attempt;
      console.log(`Rate limited, waiting ${wait}s...`);
      await new Promise(r => setTimeout(r, wait * 1000));
      continue;
    }
    if (resp.status === 403) {
      const body = await resp.text();
      if (body.toLowerCase().includes("csrf")) throw new Error("CSRF_INVALID");
      throw new Error(`Forbidden: ${body}`);
    }
    if (!resp.ok) throw new Error(`API error ${resp.status}: ${await resp.text()}`);
    return resp.json();
  }
  throw new Error("Max retries exceeded");
}

async function refreshTokens(api, refreshToken) {
  const resp = await fetch(`${api}/auth/refresh`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ refresh_token: refreshToken }),
  });
  if (!resp.ok) throw new Error("Refresh failed — re-authenticate from scratch");
  return resp.json(); // { access_token, csrf_token }
}

bash (parallel curl)

# Fetch all config in one shot (4 parallel requests)
TOKEN="your_access_token"
API="https://us-west-01-firestarter.pipenetwork.com"

# Run in parallel with &
curl -s "$API/user/me" -H "Authorization: Bearer $TOKEN" > /tmp/me.json &
curl -s "$API/api/s3/info" -H "Authorization: Bearer $TOKEN" > /tmp/s3info.json &
curl -s "$API/api/s3/bucket" -H "Authorization: Bearer $TOKEN" > /tmp/bucket.json &
curl -s "$API/api/credits/status" -H "Authorization: Bearer $TOKEN" > /tmp/credits.json &
wait

# Assemble config
cat <<EOF
PIPE_API_BASE=$API
PIPE_API_KEY=$(jq -r .user_app_key /tmp/me.json)
AWS_ENDPOINT_URL=$(jq -r .endpoint /tmp/s3info.json)
AWS_DEFAULT_REGION=$(jq -r .region /tmp/s3info.json)
PIPE_S3_BUCKET=$(jq -r .bucket_name /tmp/bucket.json)
PIPE_BALANCE=$(jq -r .balance_usdc /tmp/credits.json)
EOF

Python (concurrent)

import requests
from concurrent.futures import ThreadPoolExecutor

API = "https://us-west-01-firestarter.pipenetwork.com"
headers = {"Authorization": f"Bearer {TOKEN}"}

def get(path):
    return requests.get(f"{API}{path}", headers=headers).json()

# Fetch all config in parallel
with ThreadPoolExecutor(max_workers=4) as pool:
    me_f      = pool.submit(get, "/user/me")
    s3info_f  = pool.submit(get, "/api/s3/info")
    bucket_f  = pool.submit(get, "/api/s3/bucket")
    credits_f = pool.submit(get, "/api/credits/status")

config = {
    "api_base":    API,
    "api_key":     me_f.result()["user_app_key"],
    "endpoint":    s3info_f.result()["endpoint"],
    "region":      s3info_f.result()["region"],
    "bucket":      bucket_f.result()["bucket_name"],
    "balance_usdc": credits_f.result()["balance_usdc"],
}
print(config)

.github/workflows/upload.yml

name: Pipe Storage Upload
on:
  push:
    branches: [main]

jobs:
  upload:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install AWS CLI
        run: |
          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscli.zip
          unzip -q awscli.zip && sudo ./aws/install

      - name: Upload to Pipe Storage
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.PIPE_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.PIPE_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.PIPE_AWS_REGION }}
          AWS_ENDPOINT_URL: ${{ secrets.PIPE_AWS_ENDPOINT_URL }}
          PIPE_S3_BUCKET: ${{ secrets.PIPE_S3_BUCKET }}
        run: |
          # Upload build artifacts (example: dist/ folder)
          aws s3 sync ./dist s3://$PIPE_S3_BUCKET/releases/$GITHUB_SHA/ \
            --endpoint-url $AWS_ENDPOINT_URL

          # Verify upload
          aws s3 ls s3://$PIPE_S3_BUCKET/releases/$GITHUB_SHA/ \
            --endpoint-url $AWS_ENDPOINT_URL