---
title: "Wallet Link"
method: POST
path: "/v1/auth/wallet/link"
---

# Wallet Link

`POST /v1/auth/wallet/link`

## Request

- Base URL: `https://api.app.membase.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.app.membase.ai/v1/auth/wallet/link`
- Auth: none declared

Backfill the signed-in account's wallet from a signed challenge.

The Privy backfill above needs an identity token, which a Privy app can simply
never issue (a dashboard setting) — but the embedded wallet can still sign, and
a signature over this server's own challenge is the proof a wallet sign-in
already accepts. Fill-empty only: an account that has a wallet keeps it.

A session mutation, so it takes CSRF like every other one.

## Request body

- WalletSignInRequest
  - `message` string, required
  - `signature` string, required
  - `invite_code` string

## Response `200`

Successful Response

- SessionView
  - `account_id` string, required
  - `method` string, required
  - `expires_at` string, required
  - `csrf_token` string, required
  - `role` string, nullable
  - `email` string, nullable
  - `display_name` string, nullable
  - `wallet` string, nullable

## Other responses

- `422`: Validation Error
- `default`: Error envelope (ADR 0027)

---

[API](https://skmtc.dev/membase/apis/membase-hosted-api.md) · [All operations](https://skmtc.dev/membase/apis/membase-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/membase/apis/membase-hosted-api/revisions/e0ac58cdb320?raw)