> ## Documentation Index
> Fetch the complete documentation index at: https://docs.request.network/llms.txt
> Use this file to discover all available pages before exploring further.

# Wallet Authentication (SIWE)

> Sign-In with Ethereum and Tron wallet authentication for session-based API access

## Overview

Wallet authentication uses the [Sign-In with Ethereum (SIWE)](https://eips.ethereum.org/EIPS/eip-4361) standard to authenticate users via their wallet signature. After verification, the API sets an httpOnly session cookie for subsequent requests.

This is the authentication method used by the [Request Dashboard](https://dashboard.request.network) and is required for managing [payee destinations](https://docs.request.network/api-features/payee-destinations.md) and [client IDs](https://docs.request.network/api-features/client-id-management.md).

## Supported Wallets

* **EVM wallets** — MetaMask, WalletConnect, Coinbase Wallet, and any wallet supporting `personal_sign`
* **Tron wallets** — addresses starting with `T...` (see [Recommended Tron wallets](#recommended-tron-wallets))

The API auto-detects the wallet type from the address format. Both EVM and Tron wallets are first-class authentication methods for the Dashboard and the auth API.

### Recommended Tron wallets

We rank these in order of recommendation, based on team testing:

1. **Trust** browser extension
2. **Trust** mobile app via WalletConnect (scan the QR)
3. **TronLink** browser extension
4. **Guarda** browser extension
5. **OKX** browser extension

> [!WARNING]
>
> MetaMask is not recommended for Tron — its Tron support is partial.

## Challenge/Verify Flow

**1. Request a challenge**

Call `POST /v1/auth/wallet/challenge` with the wallet address. The API returns a SIWE-formatted message to sign.

```bash theme={null}
curl -X POST "https://auth.request.network/v1/auth/wallet/challenge" \
  -H "Content-Type: application/json" \
  -d '{ "address": "0x6923831ACf5c327260D7ac7C9DfF5b1c3cB3C7D7" }'
```

```json Response (201) theme={null}
{
  "challengeId": "01HXEXAMPLE123",
  "nonce": "a1b2c3d4e5f6",
  "message": "auth.request.network wants you to sign in with your Ethereum account:\n0x6923831ACf5c327260D7ac7C9DfF5b1c3cB3C7D7\n\nSign in to Request Network.\n\nURI: https://auth.request.network\nVersion: 1\nNonce: a1b2c3d4e5f6\nIssued At: 2026-03-15T10:00:00.000Z\nExpiration Time: 2026-03-15T10:05:00.000Z",
  "expiresAt": "2026-03-15T10:05:00.000Z"
}
```

The challenge expires after 5 minutes.

**2. Sign the message**

Sign the `message` field using the wallet's signing capability.

**EVM (viem):**

```typescript theme={null}
const signature = await walletClient.signMessage({
  account,
  message: challenge.message,
});
```

**Tron (TronLink):**

```typescript theme={null}
const signature = await tronWeb.trx.signMessageV2(challenge.message);
```

**3. Verify the signature**

Submit the signature back to complete authentication. The API sets a session cookie on success.

```bash theme={null}
curl -X POST "https://auth.request.network/v1/auth/wallet/verify" \
  -H "Content-Type: application/json" \
  -c cookies.txt \
  -d '{
    "challengeId": "01HXEXAMPLE123",
    "nonce": "a1b2c3d4e5f6",
    "message": "auth.request.network wants you to sign in with your Ethereum account:...",
    "signature": "0x1234...abcdef"
  }'
```

On success, the response sets an httpOnly session cookie. Use this cookie for subsequent API calls.

## Session Management

* **Session type:** httpOnly, secure, sameSite=lax cookie
* **Wallet session timeout:** 15 minutes idle timeout
* **Logout:** `POST /v1/auth/logout` clears the session cookie

## Email/Password Authentication

For programmatic access without a wallet, the API also supports email/password authentication:

* `POST /v1/auth/register` — Create an account with email and password (8-100 chars)
* `POST /v1/auth/login` — Login with email and password
* `POST /v1/auth/logout` — Clear the session

Email/password sessions have a 30-day expiry.

## Related Pages

> [card] [Authentication](https://docs.request.network/api-reference/authentication.md)
>
> API key and Client ID authentication for API integrations.

> [card] [Payee Destinations](https://docs.request.network/api-features/payee-destinations.md)
>
> Manage receiving routes (requires wallet session).


## Related topics

- [Payee Destinations](https://docs.request.network/api-features/payee-destinations.md)
- [Restrict payer wallets](https://docs.request.network/use-cases/restrict-payer-wallets.md)
- [Authentication](https://docs.request.network/api-reference/authentication.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.