docs(api): issuer binding, scopes, and wallet sign-in

[JosueBrenes]

Documents the four changes just landed in acta-api (#108, #109, #110, #111), in en/es/fr.

• Issuer binding. The old text described the previous behaviour, where binding the recipient meant a standard key could only issue credentials to itself. Reads and moves still bind owner, which is correct there.
• Scopes. How to request a narrow key, and that a key with no scopes is unrestricted, so nothing issued earlier changed.
• Wallet sign-in. Documented as the credential browsers should prefer, with why it is stronger than a bearer key: a session can only be minted by whoever controls the wallet. API keys stay the right answer for server-side integrations.

Summary by CodeRabbit

• Documentation
  • Clarified authentication rules for credential ownership and issuance operations.
  • Documented how issuance credentials are associated with issuers and optional source keys, while recipients remain unrestricted.
  • Added details on on-chain issuer authorization and API key scopes, including insufficient-scope behavior.
  • Documented browser wallet sign-in using signed challenges and session tokens across supported languages.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
acta-docs	Ready	Preview	Aug 11, 2026 10:59pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f2f01679-ef9a-4d53-a874-11ee75f8ed46

📥 Commits

Reviewing files that changed from the base of the PR and between c1d1be7 and 4e91c87.

⛔ Files ignored due to path filters (1)

• packages/docs-mcp/src/generated/docs-data.json is excluded by !**/generated/**

📒 Files selected for processing (3)

• src/content/docs/modules/api-reference/en/overview.ts
• src/content/docs/modules/api-reference/es/overview.ts
• src/content/docs/modules/api-reference/fr/overview.ts

---

📝 Walkthrough

Walkthrough

The API reference now separates vault ownership checks from issuer authorization. Issuance binds API keys to issuer and optional sourcePublicKey, while owner remains unrestricted. The documentation also covers API-key scopes, insufficient-scope responses, and browser wallet session authentication in three languages.

Changes

Authentication documentation

Layer / File(s)	Summary
Authentication rules and sign-in flow src/content/docs/modules/api-reference/*/overview.ts	The English, Spanish, and French documentation separates vault ownership enforcement from issuance authorization. Issuance checks issuer, optional sourcePublicKey, and on-chain authorization, while owner can be any recipient. The pages also document API-key scopes, 403 insufficient_scope responses, and wallet challenge/verify sessions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ACTA-Team/ACTA-docs#3: Both PRs update authentication documentation in the same API reference files. This PR refines issuer and owner enforcement and adds API-key scope details.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/api-key-model

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}