The endpoint is the storefront. Pay $0.01 USDC on Base over x402 and the key is yours — serialized, signed to your address, on a public ledger.

$ curl -s https://dirac.freysa.dev/api/keys/pull
402 {"accepts":[{"scheme":"exact","network":"base",
  "maxAmountRequired":"10000","payTo":"0x997f…637F"}]}

# sign EIP-3009 for $0.01, retry:
$ curl -s -H "X-PAYMENT: $PAY" …/api/keys/pull
200 {"hash":"0x00a4…","tier":"RARE","grade":9,
  "hashes_owned":"2^161","certificate":{"signature":"0x…"}}

Odds: /api/keys/odds · Your keyring: /api/keys/ring/{addr}

You pull a key — a random SHA-256 hash. Its rarity isn't assigned; it's a fact about the hex. Leading zeros set the tier (each zero is 16× rarer, exactly like proof-of-work). The last bytes fix a card-grade. Patterns in the digits are traits.

You own a region of keyspace — every hash sharing your key's prefix. Rarer keys own exponentially more: a common owns a few grains, a mythic owns galaxies. Paid keys come with a signature from the house proving it's yours.

Demo keys live in your browser and are owned by no one. Real ownership is the paid x402 path.