Auth

SIWE login (first login creates account)

Submit raw challenge message and signature. Request Origin mode must match challenge: browser challenge must send same Origin (https://<stored domain>), programmatic challenge must omit Origin, otherwise returns 400 siwe_invalid (reason domain_mismatch). Verification failure returns 400 siwe_invalid with reason indicating failure type (expired, chain_mismatch, domain_mismatch, signature; nonce reuse classified as expired). Message must be submitted verbatim: modifying any content (including Chain ID) results in reason signature; chain_mismatch occurs only if configured Chain ID changes after challenge issuance. If wallet identity does not exist, an account is created (account_created: true, new account balance 0).

Scope of support:

  • Supported: EOA wallets on Ethereum mainnet (Chain ID 1).
  • Not supported: Any other chains (Chain ID is embedded by server; submitting modified Chain ID fails byte-for-byte check returning 400 siwe_invalid, reason signature), contract wallets (EIP-1271), and smart accounts (eth_call verification not supported; mismatch returns siwe_invalid).
post/auth/siwe/login

Request

  • Base URL: https://console-api.blockvectra.com/v1
  • URL: https://console-api.blockvectra.com/v1/auth/siwe/login
  • Auth: none required

Request body

messagestring required

EIP-4361 message (LF line endings, no trailing newline), up to 2048 bytes.

signaturestring required

65-byte ECDSA signature (r||s||v).

refstring nullable

Optional sign-up channel attribution tag, saved once only when creating a new account. Lowercase letters, digits, ., _, -, 1–64 characters; any other value (including uppercase, empty string) returns 400 invalid_request without case folding.

referrerstring nullable

Optional referrer URL or hostname, saved once only when creating a new account, storing hostname only (lowercase, IDNA ASCII, without protocol, port, path, query). An omitted or null referrer is treated as omitted. A string from which no usable hostname can be extracted, including a blank string, is also treated as omitted (stored as null), with account creation succeeding normally. Only non-null, non-string values return 400 invalid_request.

Example request

{
  "ref": "hn.launch-2026",
  "referrer": "https://news.ycombinator.com/item?id=1"
}

Response

Login successful. Session token appears only this once; response includes Cache-Control: no-store.

account_createdboolean required

Whether this login created a new account.

Example response

{
  "session": {
    "expires_at": "2026-09-26T08:00:00Z"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.