Skip to main content
POST
Verify a wallet link challenge

Authorizations

Authorization
string
header
required

Session JWT (from register/login) or API key (pk_...). X-API-Key: <token> is accepted as an alternative header.

Body

application/json
nonce
string
required

The nonce of the challenge being solved.

signature
string
required

The chain-native signature of the challenge envelope.

Response

Wallet linked.

External wallet (custody=client) linked to the account by signing a nonce challenge. The challenge expires 10 minutes after issuance; once the wallet is linked, the link stays active until it is revoked.

proof
object

Cryptographic proof that a wallet signed a structured CBPay message (EIP-191 ETH/EVM, TIP-191 TRON). Publicly verifiable via verify_url. The envelope is the exact anti-phishing message the wallet signed (Domain / Purpose / Wallet / Nonce / Issued / Expires / Statement lines; the Account line only appears for wallet_link proofs). Proofs live 10 minutes (expires_at); a signed proof stays publicly verifiable after expiry.

Last modified on August 22, 2026