auth.v1.SubaccountService
CreateSubaccountChallenge
Request the canonical next smart account and a short-lived account-control authorization bound to the authenticated root and selected owner wallet.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/auth.v1.SubaccountService/CreateSubaccountChallenge' \
--header 'Content-Type: application/json' \
--header 'Connect-Protocol-Version: 1' \
--data '{
"ownerAddress": "0x5555555555555555555555555555555555555555",
"uri": "https://devnet.polyester.com"
}'Responses
{
"expiresAt": "2026-01-01T00:05:00Z",
"message": "Polyester account authorization\n\nCreate a sub-account controlled by the smart account below.\nThis does not authorize a transaction or a login.\n\naction: create_subaccount\norigin: https://devnet.polyester.com\naudience: devnet\npolyester_chain_id: 888168\nroot_account_id: 123456789\nowner_address: 0x5555555555555555555555555555555555555555\nsmart_account_address: 0x2222222222222222222222222222222222222222\nsalt_nonce: 1\nrequest_id: 8f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de6058f3a72c91b4de605\nissued_at: 2026-01-01T00:00:00Z\nexpiration: 2026-01-01T00:05:00Z",
"polyesterChainId": "888168",
"smartAccountAddress": "0x2222222222222222222222222222222222222222",
"smartAccountSaltNonce": 1
}auth.v1.CreateSubaccountChallengeRequestauth.v1.CreateSubaccountChallengeResponseSelected EOA bound to the authenticated root account.
Requesting browser origin including scheme and optional port, without path, query, fragment, or user information. Must match the HTTP Origin when present.
Exact UTF-8 EIP-191 personal_sign message. This is an account-control authorization, not an EIP-4361 sign-in message. Sign through the returned smart account; do not hash, alter, or reconstruct the message.
Canonical address of the next smart account, derived by the server.
Canonical derivation salt nonce for the returned smart account.
Expiration in UTC, five minutes after issuance.
Polyester EIP-155 chain ID used for smart-account derivation and verification.
| Key | HTTP status | Connect code | Error | When |
|---|---|---|---|---|
| unauthenticated | 401 | unauthenticated | Unauthenticated | Authentication required. |
| permission-denied | 403 | permission_denied | Permission Denied | Permission denied. |
| invalid-argument | 400 | invalid_argument | Invalid Argument | Invalid argument. |
| not-found | 404 | not_found | Not Found | Not found. |
| unavailable | 503 | unavailable | Unavailable | Service unavailable. |