Your wallet
is your API key

Stateless authentication for APIs using wallet signatures. No API keys to generate, copy, or rotate. The agent's wallet is the credential.

$ npm install @walletauth/server
$ yarn add @walletauth/server
$ pnpm add @walletauth/server
The problem

API keys

  • Generate manually
  • Copy-paste to agent
  • Store in env/vault
  • Rotate periodically
  • Revoke when leaked
  • One key per agent
→

Wallet auth

  • Agent already has a wallet
  • Signs a challenge
  • Gets a JWT
  • Done
How it works

1. Agent sends its address. Server returns a challenge — a random nonce signed with HMAC. No database, no state.

2. Agent signs the nonce with its private key. EVM or Solana.

3. Server verifies HMAC + wallet signature, issues a JWT.

4. Agent uses the JWT as a standard Bearer token.

20 lines
import { createChallenge, verifySignature,
         issueToken, verifiers } from '@walletauth/server'

// agent requests a challenge
app.post('/auth/challenge', (req, res) => {
  res.json(createChallenge(req.body.address, SECRET))
})

// agent signs nonce, sends back signature + challenge
app.post('/auth/verify', async (req, res) => {
  const { address, signature, challenge } = req.body
  const ok = await verifySignature(
    address, signature, challenge, SECRET, verifiers.evm
  )
  if (!ok) return res.status(401).json({ error: 'bad signature' })
  res.json({ token: await issueToken(address, SECRET) })
})
Details
Stateless

Challenges are HMAC-signed. No nonce table, no Redis, no session store. Verification is a pure function.

Multi-chain

EVM and Solana/ed25519 built-in. Pass an array of verifiers for multi-chain APIs. Bring your own for other chains.

~7KB

Three runtime dependencies: @noble/curves, @noble/hashes, jose. No ethers.js.

Framework-agnostic

Four pure functions. Works with Express, NestJS, Fastify, Hono, or a raw HTTP server.

TypeScript

Written in strict TypeScript. Full declarations with JSDoc. ESM and CJS.

Tested

56 tests covering cryptographic edge cases, timing attacks, and input validation. CI on Node 18, 20, 22.

Get started
$ npm install @walletauth/server
docs → source →
MIT License