# Totym

Token-gated communities. A creator points a community at a token; a visitor's access is decided server-side against the chain and fails closed.

## What is verifiable

- Live figures with their sources: https://www.totym.io/proof
- Dependency health, measured per request: https://www.totym.io/api/health
- The public API, machine-readable: https://www.totym.io/api
- Security model and known limits: https://www.totym.io/security
- SDK: @totym/sdk@0.3.0 on npm, source at https://github.com/useTotym/TotymSDK
- The application server is closed source. Said here rather than left to be inferred from a missing link; the SDK above is the part that can be read and verified independently.

## Token

- $TOTYM does not exist yet — no mint, no presale, nothing promised.

## API

6 endpoints are CORS-open and readable from any origin. Each example below returns 200.

### /api/sdk/challenge
- Returns: A single-use nonce and the exact message to sign
- Chains: Solana · EVM
- CORS: open
- POST body (required): address and chain
- Example: https://www.totym.io/api/sdk/challenge

### /api/sdk/session
- Returns: A short-lived token, in exchange for a signature over the challenge
- Chains: Solana · EVM
- CORS: open
- POST body (required): address, chain, signature, nonce
- Example: https://www.totym.io/api/sdk/session

### /api/sdk/access
- Returns: A verified access decision — allow, deny or unknown
- Chains: Solana · EVM
- CORS: open
- Authorization (required): Bearer <session token>
- Example: https://www.totym.io/api/sdk/access
- Note: No wallet parameter exists on this route. The token proves the address, which is the difference between this and the lookups below.

### /api/check-access
- Returns: The balance an address holds of a mint, and whether it clears a minimum
- Chains: Solana
- CORS: open
- wallet (required): the address to look up
- mint (required): the token mint
- minimum (optional): the balance to compare against
- network (optional): mainnet (default) or devnet
- gate_type (optional): token (default) or nft
- Example: https://www.totym.io/api/check-access?wallet=6J8eyphbPTvvUtswqbcfxSdZJF88pbWFoeYmYcN7pD4c&mint=So11111111111111111111111111111111111111112&minimum=0
- Note: Answers about an address the CALLER supplied, so every response carries verified: false. Gating on it opens the door for anyone who pastes a whale's address. Use /api/sdk/access for a decision.

### /api/check-access-evm
- Returns: The same, for EVM chains
- Chains: Ethereum · Base · Robinhood Chain
- CORS: open
- wallet (required): the address to look up
- contract (required): the token contract
- chain_id (required): 1, 8453 or 4663
- gate_type (optional): erc20 (default) or erc721
- minimum (optional): the balance to compare against
- Example: https://www.totym.io/api/check-access-evm?wallet=0x6262032b8a6f82d7c63897bc44288f76753f8442&contract=0x4200000000000000000000000000000000000006&chain_id=8453&gate_type=erc20&minimum=0
- Note: Same verified: false caveat as the Solana lookup.

### /api/token-metadata
- Returns: Name, symbol, logo and supply for a mint
- Chains: Solana
- CORS: open
- mint (required): the token mint
- network (optional): mainnet (default) or devnet
- Example: https://www.totym.io/api/token-metadata?mint=So11111111111111111111111111111111111111112

### /api/token-metadata-evm
- Returns: The same, for an ERC-20 or ERC-721 contract
- Chains: Ethereum · Base · Robinhood Chain
- CORS: open
- contract (required): the token contract
- chain_id (required): 1, 8453 or 4663
- Example: https://www.totym.io/api/token-metadata-evm?contract=0x4200000000000000000000000000000000000006&chain_id=8453

### /api/holder-count
- Returns: How many addresses hold a mint
- Chains: Solana
- CORS: open
- mint (required): the token mint
- network (optional): mainnet (default) or devnet
- Example: https://www.totym.io/api/holder-count?mint=So11111111111111111111111111111111111111112

### /api/profile
- Returns: A wallet's Totym profile, with ENS and .sol names where they resolve
- Chains: Solana · EVM
- CORS: open
- wallet (required): the address to look up
- Example: https://www.totym.io/api/profile?wallet=6J8eyphbPTvvUtswqbcfxSdZJF88pbWFoeYmYcN7pD4c

### /api/communities
- Returns: Published communities, with each one's gate, chain and token
- Chains: Solana · EVM
- CORS: same-origin only (public, but not cross-origin)
- limit (optional): how many rows, default 24
- offset (optional): where to start, default 0
- search (optional): matches name, slug or symbol
- sort (optional): newest (default)
- network (optional): all (default), mainnet or devnet
- is_claimed (optional): true to exclude unclaimed listings
- Example: https://www.totym.io/api/communities?limit=10

### /api/communities/count
- Returns: Population counts — published, paused, unclaimed listings, test, archived, total rows, and memberships
- CORS: same-origin only (public, but not cross-origin)
- Takes no parameters
- Example: https://www.totym.io/api/communities/count
- Note: The populations are named, not partitioned — a devnet row can also be archived — so they deliberately do not sum to rows.

### /api/health
- Returns: Every dependency with its state, latency and what breaks without it. No provider text reaches the caller.
- CORS: same-origin only (public, but not cross-origin)
- Takes no parameters
- Example: https://www.totym.io/api/health

## What this is not

- Not a launchpad competitor. Totym launches tokens THROUGH pump.fun, PONS and Raydium rather than replacing them; the product is the gated community the token unlocks.
- /api/check-access answers about an address the caller supplies, so every response carries verified: false. It is a balance lookup, not an access decision. /api/sdk/access is the verified one and takes no wallet parameter.