Spec aligned to implemented backend
SIWE architecture spec
SIWE (EIP-4361) spec: nonce, verification, sessions, and replay safety
This spec documents implemented nonce, verification, and session paths. Environment hardening and front-end wallet UX remain deployment concerns.
- Nonce request: client requests a nonce from
/api/v1/nonce. - Message creation: client constructs a standard EIP-4361 payload for the chosen chain and domain.
- Signature verification: backend verifies the message and signature using the SIWE runtime.
- Session issuance: authenticated wallet sessions are issued and can be read from
/api/v1/session.
Evidence, freshness, and corrections
- Written and edited by
- Rachel Julian, founder and editor
- Last reviewed
- 2026-08-13
- Readiness rule
- Scaffold means designed, not implemented. Beta means implemented with production verification pending. Live means independently verified end to end. Source code, ABI files, endpoints, or configuration never prove production availability.
- Correction path
- Report a correction or compare the capability changelog.
Source hierarchy
- Primary standards: Protocol specifications and standards bodies define what an implementation must do.
- Security guidance: Threat-model and identity guidance define controls, failure handling, and recovery expectations.
- Deployment evidence: Independent end-to-end checks establish whether a configured production capability is live.
- Editorial judgment: I apply those sources to revenue-travel decisions and state where the evidence stops.