Openfort Hot Storage API
Stores the "hot" key share for a signer's devices and accounts.
Authentication
Every endpoint in this document requires a bearer token. The whole API mux is
wrapped in authMiddleware, which rejects any request it cannot resolve to a
user with 401 before the handler runs. There are no anonymous endpoints here;
/health is served outside this API surface and is not documented below.
The token is validated according to the X-Auth-Provider header. When that
header is absent the default provider is used and the token is verified
against the auth service's JWKS; other providers verify third-party tokens.