auth.v1.AuthService
LoginWithWallet
Verify a signed EIP-4361 message and issue an access token. Login and account creation do not accept terms; explicit consent is recorded only by AcceptTerms.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/auth.v1.AuthService/LoginWithWallet' \
--header 'Content-Type: application/json' \
--header 'Connect-Protocol-Version: 1' \
--data '{
"ip": "203.0.113.42",
"message": "devnet.polyester.com wants you to sign in with your Ethereum account:\n0x5555555555555555555555555555555555555555\n\nSign in to Polyester. This does not authorize a transaction.\n\nURI: https://devnet.polyester.com\nVersion: 1\nChain ID: 1\nNonce: 8f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de605\nIssued At: 2026-01-01T00:00:00Z\nExpiration Time: 2026-01-01T00:05:00Z\nRequest ID: 8f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de605\nResources:\n- urn:polyester:wallet-challenge:login:eip155:888168:0x2222222222222222222222222222222222222222",
"signature": "0xabcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
"smartAccountAddress": "0x2222222222222222222222222222222222222222",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/126.0 Safari/537.36",
"walletProvider": "metamask"
}'Responses
{
"accessToken": "eyJhbGciOiJFZERTQSJ9.example.signature",
"accountId": "7563897446546",
"expiresAt": "2025-01-01T00:00:00Z",
"session": {
"authTime": "2025-01-01T00:00:00Z",
"authenticationMethods": [
"totp"
],
"sessionId": "session_01J0EXAMPLE",
"sessionLevel": "PRIMARY_AUTHENTICATED"
},
"username": "trader_alpha"
}auth.v1.LoginWithWalletRequestauth.v1.LoginWithWalletResponseSmart-account EVM address bound into the challenge resource, formatted as 0x plus 40 hex characters.
EOA signature over message using EIP-191 personal_sign semantics. A valid value is 65 bytes of hexadecimal with an optional 0x prefix. Requests are limited to 8192 characters.
Optional user-agent string for account security and audit displays. Maximum length is 512 characters.
Optional caller IP address for account security and audit displays. Maximum length is 64 characters.
Optional provider hint for the signing wallet. Maximum length is 32 characters.
Exact EIP-4361 message returned by CreateWalletChallenge. Maximum length is 4096 UTF-8 bytes.
Bearer access token for authenticated API calls.
Time in UTC when access_token expires.
Root account the token is bound to (opaque ID).
Optional current username for the root account (empty if not set).
Stable session identifier shared by the primary and MFA-elevated tokens.
Assurance level represented by this session response.
Authentication methods used for this session state, such as wallet, TOTP, passkey, or recovery code. Maximum 8 unique values.
Time when the session was authenticated or elevated.
| Key | HTTP status | Connect code | Error | When |
|---|---|---|---|---|
| unauthenticated | 401 | unauthenticated | Unauthenticated | Authentication required. |
| permission-denied | 403 | permission_denied | Permission Denied | Permission denied. |
| invalid-argument | 400 | invalid_argument | Invalid Argument | Invalid argument. |
| not-found | 404 | not_found | Not Found | Not found. |
| unavailable | 503 | unavailable | Unavailable | Service unavailable. |