Authentication¶
Different surfaces use different authentication, each matched to its risk profile.
Overview¶
| Surface | Method | Notes |
|---|---|---|
Public API (/public, /discovery) |
None | Read-only by design |
| Earn app & partner portal | JWT bearer tokens (email or wallet login) | Short-lived tokens, refresh handled by the app |
| Wallet sign-in | SIWE (EIP-4361) | Signed message proves wallet control; nonce, domain, and chain-id bound |
| Partner API | HMAC-SHA256 request signing | X-API-KEY / X-SIGNATURE / X-TIMESTAMP; see Partner API |
| On-chain actions | The user's own wallet signature | Deposits/withdrawals are signed by the user; the platform is not in the loop |
User authentication (JWT + SIWE)¶
Users sign in with email or a wallet through an embedded authentication provider that issues JWTs. Wallet login uses Sign-In with Ethereum (EIP-4361): the app issues a challenge, the user signs it, and the signature — bound to the domain, chain id, nonce, and expiry — proves control of the address without exposing any secret.
The backend validates tokens on every request and derives the caller's memberships and role (platform, partner admin, strategist, investor), which gate every operation server-side. The frontend mirrors the same role/permission model for UI gating, but authorization is enforced at the API.
Sensitive operations¶
Operations with financial impact inside the partner portal add a second factor beyond the session: the acting wallet produces an EIP-712 typed-data signature over the specific action, which accompanies the request. A stolen session token alone is not sufficient to trigger execution-class operations.
Partner API (HMAC)¶
Programmatic partner access uses exchange-style HMAC-SHA256 request signing with timestamp-bounded replay protection — described in detail in the Partner API page. Signature handling is part of the independent audit scope.
The most important property¶
For the flows that move user money — deposits and withdrawals — the authentication is the user's own wallet signature on-chain. There is no platform credential whose compromise allows spending user funds; see Custody & Key Management.