Verify signature

Authentication · Acts onchain

Exchanges a signed Sign-In with Ethereum message for an access and refresh token pair. The server checks the signature against the message, confirms the nonce is the one it issued, and mints the pair: a short-lived access token that authenticates requests and a refresh token that rotates it. Step two of three in wallet authentication. Reach for it with the output of the wallet's signing prompt, then hold both tokens; the session lives exactly as long as the refresh rotation continues.

Send a request

Request body

{
    message: string
    signature: string
}

Response

{
    data: {
        access_token: string
        refresh_token: string
        expires_in: number
    }
}

Code samples

Language

Prompt

Call the Plug API endpoint "Verify signature".

## Endpoint
POST /auth/verify
Base URL: https://api.plug.to

## Description
Exchanges a signed Sign-In with Ethereum message for an access and refresh token pair.

The server checks the signature against the message, confirms the nonce is the one it issued, and mints the pair: a short-lived access token that authenticates requests and a refresh token that rotates it. Step two of three in wallet authentication.

Reach for it with the output of the wallet's signing prompt, then hold both tokens; the session lives exactly as long as the refresh rotation continues.

## Request Body
- message (string, required) — The exact SIWE message that was signed, verbatim.
- signature (string, required) — Hex signature of the SIWE message produced by the wallet.

## Response Schema
- data (object, required)
  - access_token (string, required) — Bearer token for the Authorization header.
  - refresh_token (string, required) — Token used to rotate the pair once the access token expires.
  - expires_in (integer, required) — Access token lifetime in seconds from issuance.

## Example Request
POST https://api.plug.to/auth/verify

Get nonce

Refresh token

Back