Sign-in

Listing a package, the dashboard and history need a wallet session. Buying a package doesn't: the payment itself proves who you are.

A session is an HttpOnly cookie, valid for 30 days, tied to one wallet address. These endpoints work only from agentware.sh.

1. Get a message to sign

POST /api/auth/nonce
{ "address": "0xYourWallet" }

{ "nonce": "…", "message": "agentware.sh wants you to sign in to Agentware with your wallet:\n0xYourWallet\n\nSign this message to prove you control this wallet. No transaction, no gas.\n\nNonce: …" }

The nonce is valid for ten minutes and can be used once.

2. Send the signature

Sign message exactly as given with personal_sign, then:

POST /api/auth/verify
{ "address": "0xYourWallet", "nonce": "…", "signature": "0x…" }

{ "address": "0xyourwallet" }

Smart-contract wallets are supported. A wrong signature or a reused nonce returns 401. A missing field returns 400.

Who am I

GET /api/me

{ "address": "0xyourwallet" }

address is null when there's no session.

Sign out

POST /api/auth/logout

{ "ok": true }