Authorization: Bearer <access_token>

// After OAuth authentication
const response = await fetch('https://auth.sigmaidentity.com/api/backup/status', {
  headers: {
    'Authorization': `Bearer ${accessToken}`
  }
});

import { encryptBackup, type WifBackup } from 'bitcoin-backup';

// 1. Authenticate user
const accessToken = await authenticateUser();

// 2. Create backup object and encrypt client-side
const backup: WifBackup = {
  wif: privateKey.toWif(),
  label: 'My Wallet',
  createdAt: new Date().toISOString()
};
const encryptedBackup = await encryptBackup(backup, password);

// 3. Store encrypted backup
await fetch('https://auth.sigmaidentity.com/api/backup', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    encryptedBackup: encryptedBackup,
    oauthProvider: 'google', // Optional: link to OAuth account
    oauthId: '123456789'     // Optional: OAuth account ID
  })
});

// Authenticated retrieval by BAP ID (when user has their key)
const backup = await fetch('https://auth.sigmaidentity.com/api/backup?bapId=Go8vCHAa4S6AhXKTABGpANiz35J', {
  headers: {
    'Authorization': `Bearer ${accessToken}`
  }
});

// OAuth-based retrieval (for cross-device restore, no auth required)
const oauthBackup = await fetch(
  'https://auth.sigmaidentity.com/api/backup?oauthId=google|123456789'
);

// Both return the same format:
const data = await backup.json();
// { backup: "encrypted_blob_string" }

// Link an OAuth account to your BAP ID for recovery
// Useful when you already have a backup but want to add a new OAuth recovery method
await fetch('https://auth.sigmaidentity.com/api/backup/link-oauth', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    provider: 'google',
    providerAccountId: '123456789'
  })
});

// Response:
// {
//   success: true,
//   message: "OAuth account linked successfully",
//   bapId: "Go8vCHAa4S6AhXKTABGpANiz35J"
// }

// Error if account already linked to different identity:
// {
//   error: "This OAuth account is already linked to another identity",
//   existingBapId: "DifferentBapId123",
//   code: "OAUTH_ALREADY_LINKED"
// }

{
  "error": "unauthorized",
  "error_description": "Invalid or expired authentication token"
}

{
  "error": "authentication_required",
  "error_description": "This endpoint requires authentication"
}