Sign in / register by submitting a signed challenge.
Verifies the wallet signature against the most recent unconsumed challenge for the address, creates or refreshes the account row, and sets an HttpOnly session cookie bound to the verified wallet. The CSRF token is returned in the body (echo it back in the x-csrf-token header on subsequent mutating requests) and also set as a readable cookie.
Authorizations
HttpOnly session cookie set by POST /v1/auth/session. Mutating requests must also send the CSRF token (returned by that call) in the x-csrf-token header.
Body
Alephium address (base58, optional :N group suffix).
30 - 80^[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz:]+$Public key whose hash equals address (33-byte compressed, hex).
^(0x)?[0-9a-fA-F]+$Signature produced by signMessage(challenge, "alephium").
^(0x)?[0-9a-fA-F]+$Wallet key type. gl-secp256k1 = groupless embedded wallet (the type the app uses); default = grouped extension/desktop wallet.
default, gl-secp256k1 The exact challenge text that was signed. Send this when the challenge was issued without an address (the server consumes it by text). Omit it when the challenge was issued for a known address (it is then consumed by address).
Optional referrer wallet, captured once on first registration. Ignored if it equals the caller or does not exist.
30 - 80^[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz:]+$Wallet provenance, persisted for support/debugging (embedded = self-hosted signer; the wallet-svc user id is never signing authority).
Set true to also receive the session token in the response body, for scripted callers that would rather send Authorization: Bearer <token> than keep a cookie jar. Browser clients should leave this false so their only copy of the credential stays in the HttpOnly cookie.
Response
Default Response
Alephium address (base58, optional :N group suffix).
30 - 80^[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz:]+$CSRF token. Send it as the x-csrf-token header on mutating requests. Not needed for Bearer callers.
true when this call created a new account row.
The session token, present only when issueToken was true. Send it as Authorization: Bearer <token>. It is the same credential as the cookie, so it carries the same expiry and is equally worth protecting.
ISO-8601 expiry of the returned token. Present only alongside token.