Error

A valid request URL is required to generate request examples

{
  "challenge": "<string>",
  "expiresAt": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "requestId": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "requestId": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "requestId": "<string>",
    "details": "<unknown>"
  }
}

Auth

Mint a one-time signing challenge.

Returns a short text the wallet must sign to prove ownership. The signed result is then submitted to POST /v1/auth/session to establish a session. address is optional: omit it when the address is only known after authentication to get a generic nonce, which the session call consumes by its exact text.

Rate limited per target address (10/minute) as well as per caller, so nobody can flood live nonces against a wallet they do not control.

POST

auth

challenge

Error

A valid request URL is required to generate request examples

{
  "challenge": "<string>",
  "expiresAt": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "requestId": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "requestId": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "requestId": "<string>",
    "details": "<unknown>"
  }
}

Authorizations

aura_session

string

required

HttpOnly session cookie set by POST /v1/auth/session. Mutating requests must also send the CSRF token (returned by that call) in the x-csrf-token header.

Body

application/json

address

string

Alephium address (base58, optional :N group suffix).

Required string length: 30 - 80

Pattern: ^[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz:]+$

Response

Default Response

challenge

string

required

Plaintext message to sign with the wallet (signMessage with hasher="alephium").

expiresAt

string

required

ISO-8601 expiry (5 minutes from issuance).

Last modified on August 11, 2026

Get Started

Guides

Reference

Endpoints

Realtime Stream

Mint a one-time signing challenge.

Authorizations

Body

Response