# signal.forsale

signal.forsale is an API-first marketplace for numberless Signal Login accounts. Buyers and sellers do not create marketplace accounts or connect wallets. All request and response bodies are JSON unless stated otherwise.

Base URL: https://signal.forsale
Market state: GET /api/public

## Rules

- Only Signal Login accounts created without a phone number are eligible. The seller must attest to this restriction.
- A seller submission must contain an ACI and its 64-character recovery key. The service verifies that the pair is accepted by Signal before creating a listing. Signal does not currently expose a non-destructive endpoint that independently reveals whether an account has a phone number.
- Never log, quote, or repeat a recovery key or private URL token.
- Keep each returned listingUrl or purchaseUrl private. The URL fragment contains a 256-bit bearer token.
- Requests do not require cookies, a connected wallet, Turnstile, or browser automation.
- POST requests require `Content-Type: application/json`.
- Respect HTTP 429 and retry later. Do not create duplicate purchases or listings after an ambiguous network result; first use a returned private URL if one was received.

## Discover the market

`GET /api/public`

The response includes inventory, price, whether sales are paused, and `paymentCurrencies`. Only currencies with `available: true` can be used.

## Submit a numberless Signal Login account

`POST /api/listings`

```json
{
  "aci": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "recoveryKey": "64-character Signal recovery key",
  "payouts": {
    "ETH": "0x...",
    "BASE_ETH": "0x...",
    "BTC": "bc1...",
    "XMR": "4... or 8..."
  },
  "numberlessConfirmed": true,
  "ownershipConfirmed": true,
  "keyControlConfirmed": true
}
```

Include one or more payout currencies. A successful response has HTTP 201 and includes `id`, `state`, `verificationState`, `accessToken`, and `listingUrl`. Save `listingUrl`; it is the seller's private status page.

Invalid ACI/recovery-key pairs return HTTP 400 with `{"error":"INVALID_RECOVERY_KEY"}` and no listing is created. Temporary Signal verification failures return HTTP 503 with `{"error":"SIGNAL_VERIFICATION_UNAVAILABLE"}`.

To read listing and payout status directly:

`GET /api/listings/{id}` with header `X-Listing-Token: {accessToken}`

## Create a purchase

`POST /api/purchases`

```json
{
  "currency": "BTC",
  "acceptedRisk": true
}
```

`currency` must be `ETH`, `BASE_ETH`, `BTC`, or `XMR`. A successful response has HTTP 201 and includes the exact `payAmount`, fresh `payAddress`, payment URI, status, `accessToken`, and `purchaseUrl`. Send the exact amount once and save `purchaseUrl`.

## Check and complete a purchase

Use header `X-Purchase-Token: {accessToken}` for all purchase API requests.

- `GET /api/purchases/{id}` checks payment status.
- `POST /api/purchases/{id}/reveal` with body `{}` reveals the ACI and recovery key after payment is complete.
- `POST /api/purchases/{id}/acknowledge` with body `{}` confirms that the credentials were saved and destroys the remaining delivery copy.

Poll status no faster than every 15 seconds. Typical states are `WAITING`, `PARTIALLY_PAID`, `CONFIRMING`, `COMPLETED`, `EXPIRED`, and `PAYMENT_REVIEW`. Do not send more funds after `EXPIRED` or `PAYMENT_REVIEW`; retain the private URL and contact support.

## Human-readable interface

The browser interface at https://signal.forsale uses these same endpoints. The API is the preferred interface for autonomous agents.