---
title: "Add Wallet"
method: POST
path: "/v2/profiles/{profile_id}/wallets"
tags: ["v2 - Profiles"]
---

# Add Wallet

`POST /v2/profiles/{profile_id}/wallets`

## Request

- Base URL: `https://api.jubjubapp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.jubjubapp.com/v2/profiles/{profile_id}/wallets`
- Auth: HTTP bearer

Add a wallet address to a profile.

Validates EVM format (0x + 40 hex chars). Appends if not already present.
Only the profile owner can modify their wallets, and only for a wallet
they sign for (SIWE: signature + nonce from GET /v2/auth/wallet-nonce).

Why the proof (security fix, 2026-10-22): `wallet_addresses` is what
register-viewer's SIWE re-login, x402 identity and the Farcaster FID
ownership check resolve a wallet to. An address added with no signature
let a caller claim a wallet they do not control: a later SIWE sign-in by
its real owner landed in the caller's account, and connect-fid accepted
the caller as the owner of that wallet's FID. Same rule as
/wallet-rails' SIWE path, including its cross-profile 409.

## Path parameters

- `profile_id` string, required

## Headers

- `Authorization` string
- `X-JubJub-Service-Key` string
- `X-JubJub-Agent-Key` string
- `X-JubJub-Platform-Key` string
- `Origin` string
- `Referer` string
- `X-JubJub-Trial-Token` string

## Request body

- AddWalletRequest
  - `wallet_address` string, required: EVM wallet address (0x + 40 hex chars)
  - `signature` string, nullable
  - `nonce` string, nullable

## Response `200`

Successful Response

- WalletListResponse
  - `wallet_addresses` string[], required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/jubjubapp/apis/jubjub-api.md) - [All operations](https://skmtc.dev/jubjubapp/apis/jubjub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jubjubapp/apis/jubjub-api/revisions/353157b296f2?raw)