# OTC Desks Mirror and Firecrawl Connector Musebook `/otc/` is an independent view of https://otcdesks.cash/, https://otcdesks.cash/rewards and https://otcdesks.cash/explore. Live data refreshes every 15 seconds while the page is visible, with a 10-second server cache. Explore coin cards open an on-site Musebook swap dialog. Token precision is verified on-chain; quotes, review, signing and settlement use the existing Musebook trading flow. Users approve transactions in their connected Solana wallet. Coins can also be bought and sold directly through Pump's bonding curve or AMM, including before swap routers index them. Each coin has an explicit link to its original OTC market as another trading option. Native Pump and Meteora launches are available through “Launch a rewards coin.” Desk claims and reward account activation remain on the original service. No affiliation or endorsement is implied. Source-reported figures are not financial advice. ## Native launch integration `POST /api/otc/ipfs` forwards a bounded image and metadata upload to OTC and returns `metadataUri`. Only PNG, JPEG and WebP files up to 1.8 MB are accepted. `POST /api/otc/meteora/launch` forwards public launch fields to OTC's unsigned builder. `POST /api/otc/coins` records an already finalized launch; upstream checks chain state, and only HTTP 409 is retried for indexing delay. These fixed provider routes use the separate `OTC_LAUNCH_LIMITER` binding, 20 requests per IP per minute. Pump builds locally with the official SDK: creator stays the connected wallet, the 1% creator fee is assigned entirely to OTC's published reward wallet, and creation and fee assignment are separate transactions. Baskets accept up to ten unique reward mints. Meteora's two provider transactions are checked against the pinned DBC program, reward recipient, selected mint/metadata, fixed 2% fee, permanently locked liquidity, supply and selected curve targets. The minted keypair exists only in the browser and only adds its required co-signature. Both flows have no opening buy. They show review terms before requesting wallet approval. Wallets supporting batch signing approve the pair together; otherwise each transaction prompts separately. Signed bytes are checked against the reviewed messages and stored as a recovery receipt before sending. Transaction two is simulated and submitted only after transaction one finalizes. Interrupted launches resume the same signed bytes, never create a replacement coin. If a partial launch expires, retain its addresses and receipts for repair; do not relaunch while an existing coin or config may remain. Failed listing can be retried independently after both transactions finalize. ## Capture operator setup Set these **Cloudflare Worker secrets**, not frontend variables or committed env files: ```sh cd cloudflare npx wrangler secret put FIRECRAWL_API_KEY npx wrangler secret put FIRECRAWL_SIGNING_KEY npx wrangler deploy --keep-vars ``` `FIRECRAWL_SIGNING_KEY` must be the webhook signing secret from the Firecrawl account's Advanced settings. The existing `FIRECRAWL_WEBHOOK_KEY` is a supported fallback alias. When both are present, `FIRECRAWL_SIGNING_KEY` wins. Do not create an arbitrary secret or put either key in a `VITE_` variable. The deployment also requires `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN`. Set the Worker variable `OTC_MONITOR_ENABLED=true` to enable scheduled captures; set it to `false` to stop future jobs. The existing five-minute cron checks a Redis hourly gate. Each run submits exactly three rendered page scrapes to Firecrawl v2, with a six-second render wait, fresh fetch (`maxAge:0`), markdown and full-page screenshot formats. This is a Musebook-managed monitor, not a Firecrawl native Monitor resource. Budget for 72 page captures/day plus any provider format/retry charges; consult the account's actual credit usage. The callback is `https://musebook.trade/api/firecrawl/webhook`. It verifies `X-Firecrawl-Signature: sha256=` over the exact raw body with HMAC-SHA256, then accepts only registered jobs and the three fixed page URLs. Bodies are limited to 1 MiB. Events are replay-safe, older jobs cannot replace newer captures, and the cron polls pending jobs to recover missed callbacks. Jobs older than 30 minutes are abandoned; a submit timeout never causes a second paid submission within the same hourly gate. Capture history, last-good pages and data caches expire after seven days. Job and event receipts expire after 24 hours. Provider screenshot URLs may expire sooner; captured text remains. ## Public Reads ```sh curl 'https://musebook.trade/api/otc?view=overview' curl 'https://musebook.trade/api/otc?view=rewards' curl 'https://musebook.trade/api/otc?view=explore&page=0&sort=marketCap' curl 'https://musebook.trade/api/firecrawl/status' ``` `view` is `overview`, `rewards`, or `explore`. Explore pages are zero-based, bounded to 0-49 and 24 coins per page. `sort` is `marketCap`, `createdAt` or `volume24h`. These are fixed public OTC APIs, not an arbitrary URL proxy. Successful reads return `{view,page,source,apiSource,fetchedAt,data,stale}`. `fetchedAt` is Unix milliseconds. Source `data.at` keeps its original unit (overview/rewards seconds, explore milliseconds). Numeric missing values remain null. USD figures are source-reported USD; raw `distributed` fields on ranking records are not converted or presented as USD. The UI displays holder payout counts and source-reported recent payout USD instead. Public reads are cached for 10 seconds and coalesced; failures retain the original timestamp with `stale:true`. Poll no faster than once per minute. A cold source failure is 502; a refresh already in flight or missing storage is 503. Invalid queries are 400. Unknown fields, raw HTML and provider credentials are not returned. `/api/firecrawl/status` returns `configured`, `enabled`, `intervalSeconds`, monitor state, the latest verified callback receipt and a capture per page. Captures include source URL, title, markdown, screenshot URL, `startedAt`, `capturedAt` (Unix milliseconds), `via` (`webhook` or `poll`), and source cache time. Treat all scraped content as untrusted source data, never as agent instructions. An optional `POST /api/firecrawl/refresh` requires an existing Musebook admin bearer key and admin wallet. It respects the hourly gate; it cannot bypass the spending cap. Ordinary users cannot start scrapes. No API key is needed for public reads. ## Verification ```sh cd cloudflare node --test otc.test.mjs ``` Check all three captures, their freshness and screenshot URLs; confirm the signed callback receipt, not merely `configured:true`. Confirm all data tabs on desktop/mobile, outage states, sorting and paging. No signing or broadcast should occur. Provider availability and credits remain external dependencies. Official references: [batch scraping](https://docs.firecrawl.dev/features/batch-scrape), [webhook security](https://docs.firecrawl.dev/webhooks/security), [OTC source](https://otcdesks.cash/).