API Overview
How Matrix HTTP surfaces are organized — the per-user daemon, the metered gateway, the router front door, and the agent-facing services (Chronos, Deus, LayerX, UWAC, Tachyon) — plus the shared auth patterns.
Matrix exposes several HTTP surfaces. Each is a distinct service with its own base path and auth model.
Services at a glance
| Service | Base | Auth | Purpose |
|---|---|---|---|
| Daemon | :8080 | Bearer (MATRIX_DAEMON_TOKEN) | Per-user chat + intent execution surface. |
| Gateway | /v1 | Bearer + PAX ledger | Metered, OpenAI-compatible LLM proxy. |
| Router | :443 | Supabase JWT | Public front door — wakes the user's daemon and reverse-proxies. |
| Chronos | /v1 | Agent DID | Scheduler / wake-up alarms. |
| Deus | /v1 | Developer + caller auth | Agent-service marketplace, invoke, receipts. |
| LayerX | /v1 | Agent DID | Settlement: balances, pay, withdraw, settle. |
| UWAC | /v1 | Agent DID | OAuth-vault connectors → per-user MCP tools. |
| Tachyon | /v1 | Bearer | Solidity/EVM compile, test, simulate, deploy. |
Common patterns
Agent DID authentication
Chronos, LayerX, and UWAC share a challenge/verify handshake that binds a request to an agent's ed25519 DID:
POST /v1/agent/auth/challenge with the agent DID returns a nonce to sign.
POST /v1/agent/auth/verify with the signed nonce returns a session token used for subsequent calls.
Health and version
Every service exposes GET /healthz (liveness; the daemon also returns SSE broker stats). The router additionally serves GET /v/version.
Idempotency
Money-moving endpoints (e.g. Deus POST /v1/invoke/{id}) accept an Idempotency-Key header (or an idempotency_key body field) so retries are safe.