---
title: "Privy Link"
method: POST
path: "/v1/auth/privy/link"
---

# Privy Link

`POST /v1/auth/privy/link`

## Request

- Base URL: `https://api.app.membase.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.app.membase.ai/v1/auth/privy/link`
- Auth: none declared

Backfill the signed-in account's wallet from a fresh Privy token.

Privy mints the embedded wallet *during* the first login, so the token that
login exchanged names no wallet and the account was created without one — and
since the exchange happens once per sign-in, it stayed missing for the whole
session. The web calls this as soon as the SDK reports a wallet, and gets the
updated session back so the address chip fills in without a reload.

A session mutation, so it takes CSRF like every other one, and the service
refuses a token whose subject is not this session's account.

## Request body

- PrivySignInRequest
  - `access_token` string, required
  - `invite_code` string

## Response `200`

Successful Response

- SessionView
  - `account_id` string, required
  - `method` string, required
  - `expires_at` string, required
  - `csrf_token` string, required
  - `role` string, nullable
  - `email` string, nullable
  - `display_name` string, nullable
  - `wallet` string, nullable

## Other responses

- `422`: Validation Error
- `default`: Error envelope (ADR 0027)

---

[API](https://skmtc.dev/membase/apis/membase-hosted-api.md) · [All operations](https://skmtc.dev/membase/apis/membase-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/membase/apis/membase-hosted-api/revisions/e0ac58cdb320?raw)