auth.v1.AuthService

CreateWalletChallenge

Create a short-lived EIP-4361 wallet challenge.

Method

POST

Path

auth.v1.AuthService/CreateWalletChallenge

Service

auth.v1.AuthService

Visibility

Public endpoint

POST

auth.v1.AuthService/CreateWalletChallenge

Request

Testnet

curl --request POST \ \
  --url 'https://api.testnet.polyester.com/auth.v1.AuthService/CreateWalletChallenge' \
  --header 'Content-Type: application/json' \
  --header 'Connect-Protocol-Version: 1' \
  --data '{
  "purpose": "LOGIN",
  "signerAddress": "0x5555555555555555555555555555555555555555",
  "smartAccountAddress": "0x2222222222222222222222222222222222222222",
  "uri": "https://devnet.polyester.com"
}'

Responses

{
  "expiresAt": "2026-01-01T00:05:00Z",
  "message": "devnet.polyester.com wants you to sign in with your Ethereum account:\n0x5555555555555555555555555555555555555555\n\nSign in to Polyester. This does not authorize a transaction.\n\nURI: https://devnet.polyester.com\nVersion: 1\nChain ID: 1\nNonce: 8f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de605\nIssued At: 2026-01-01T00:00:00Z\nExpiration Time: 2026-01-01T00:05:00Z\nRequest ID: 8f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de605\nResources:\n- urn:polyester:wallet-challenge:login:eip155:888168:0x2222222222222222222222222222222222222222"
}

Request

auth.v1.CreateWalletChallengeRequest

Response

auth.v1.CreateWalletChallengeResponse

smartAccountAddress string /^0x[0-…]{40}$/

Smart-account EVM address being authenticated, formatted as 0x plus 40 hex characters.

signerAddress string /^0x[0-…]{40}$/

Address whose signature authorizes the challenge and that is written into the EIP-4361 message. This must be an EOA that controls the target smart account.

uri string 1-2048 chars

Browser origin URI requesting the signature, including scheme and optional port but no path, query, fragment, or user information.

purpose enum must be defined value

Operation for which the challenge may be consumed. Must be LOGIN.

message string

Canonical EIP-4361 message. Sign these UTF-8 bytes exactly once with personal_sign; do not hash, alter, or reconstruct the message.

expiresAt string (date-time)

Time in UTC when the challenge expires. Wallet challenges expire after 5 minutes.

Possible errors: 5

Key	HTTP status	Connect code	Error	When
unauthenticated	401	unauthenticated	Unauthenticated	Authentication required.
permission-denied	403	permission_denied	Permission Denied	Permission denied.
invalid-argument	400	invalid_argument	Invalid Argument	Invalid argument.
not-found	404	not_found	Not Found	Not found.
unavailable	503	unavailable	Unavailable	Service unavailable.

POST

auth.v1.AuthService/CreateWalletChallenge

Request

Testnet

curl --request POST \ \
  --url 'https://api.testnet.polyester.com/auth.v1.AuthService/CreateWalletChallenge' \
  --header 'Content-Type: application/json' \
  --header 'Connect-Protocol-Version: 1' \
  --data '{
  "purpose": "LOGIN",
  "signerAddress": "0x5555555555555555555555555555555555555555",
  "smartAccountAddress": "0x2222222222222222222222222222222222222222",
  "uri": "https://devnet.polyester.com"
}'

Responses

{
  "expiresAt": "2026-01-01T00:05:00Z",
  "message": "devnet.polyester.com wants you to sign in with your Ethereum account:\n0x5555555555555555555555555555555555555555\n\nSign in to Polyester. This does not authorize a transaction.\n\nURI: https://devnet.polyester.com\nVersion: 1\nChain ID: 1\nNonce: 8f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de605\nIssued At: 2026-01-01T00:00:00Z\nExpiration Time: 2026-01-01T00:05:00Z\nRequest ID: 8f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de605\nResources:\n- urn:polyester:wallet-challenge:login:eip155:888168:0x2222222222222222222222222222222222222222"
}