Create authentication challenge

curl --request POST \
  --url https://staging.apimonaco.xyz/api/v1/auth/challenge \
  --header 'Content-Type: application/json' \
  --data '
{
  "address": "0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5",
  "sessionPublicKey": "3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29",
  "clientId": "monaco-frontend",
  "chainId": "1328"
}
'

import requests

url = "https://staging.apimonaco.xyz/api/v1/auth/challenge"

payload = {
    "address": "0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5",
    "sessionPublicKey": "3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29",
    "clientId": "monaco-frontend",
    "chainId": "1328"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    address: '0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5',
    sessionPublicKey: '3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29',
    clientId: 'monaco-frontend',
    chainId: '1328'
  })
};

fetch('https://staging.apimonaco.xyz/api/v1/auth/challenge', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://staging.apimonaco.xyz/api/v1/auth/challenge",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'address' => '0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5',
    'sessionPublicKey' => '3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29',
    'clientId' => 'monaco-frontend',
    'chainId' => '1328'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://staging.apimonaco.xyz/api/v1/auth/challenge"

	payload := strings.NewReader("{\n  \"address\": \"0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5\",\n  \"sessionPublicKey\": \"3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29\",\n  \"clientId\": \"monaco-frontend\",\n  \"chainId\": \"1328\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://staging.apimonaco.xyz/api/v1/auth/challenge")
  .header("Content-Type", "application/json")
  .body("{\n  \"address\": \"0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5\",\n  \"sessionPublicKey\": \"3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29\",\n  \"clientId\": \"monaco-frontend\",\n  \"chainId\": \"1328\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://staging.apimonaco.xyz/api/v1/auth/challenge")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"address\": \"0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5\",\n  \"sessionPublicKey\": \"3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29\",\n  \"clientId\": \"monaco-frontend\",\n  \"chainId\": \"1328\"\n}"

response = http.request(request)
puts response.read_body

{
  "nonce": "abc123def456",
  "message": "Sign this message to authenticate with Monaco Protocol...",
  "expiresAt": 1699876543
}

Auth

Create authentication challenge

Create authentication challenge.

Generate a cryptographic challenge (nonce) for wallet-based authentication. The wallet must authorize the returned message to prove control of the address. An EOA does that by signing it with its private key. A smart-contract wallet has no private key and instead produces a signature its own contract will accept, which Monaco checks under EIP-1271 — see Verify.

The challenge is single-use and binds the session public key supplied here, so it authorizes exactly one keypair, once. The lifetime is 5 minutes, or 30 minutes for EVERY address while contract-signature login is enabled on the deployment — a multisig must collect owner approvals before it can answer, and the window is uniform rather than eligibility-specific so this unauthenticated endpoint cannot be used to probe which addresses hold a BuilderCodes payout bucket. Widening it is cheap: a longer window is a longer-lived offer to authorize one predetermined keypair once, never a longer-lived credential.

POST

api

auth

challenge

Create authentication challenge

curl --request POST \
  --url https://staging.apimonaco.xyz/api/v1/auth/challenge \
  --header 'Content-Type: application/json' \
  --data '
{
  "address": "0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5",
  "sessionPublicKey": "3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29",
  "clientId": "monaco-frontend",
  "chainId": "1328"
}
'

import requests

url = "https://staging.apimonaco.xyz/api/v1/auth/challenge"

payload = {
    "address": "0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5",
    "sessionPublicKey": "3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29",
    "clientId": "monaco-frontend",
    "chainId": "1328"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    address: '0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5',
    sessionPublicKey: '3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29',
    clientId: 'monaco-frontend',
    chainId: '1328'
  })
};

fetch('https://staging.apimonaco.xyz/api/v1/auth/challenge', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://staging.apimonaco.xyz/api/v1/auth/challenge",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'address' => '0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5',
    'sessionPublicKey' => '3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29',
    'clientId' => 'monaco-frontend',
    'chainId' => '1328'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://staging.apimonaco.xyz/api/v1/auth/challenge"

	payload := strings.NewReader("{\n  \"address\": \"0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5\",\n  \"sessionPublicKey\": \"3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29\",\n  \"clientId\": \"monaco-frontend\",\n  \"chainId\": \"1328\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://staging.apimonaco.xyz/api/v1/auth/challenge")
  .header("Content-Type", "application/json")
  .body("{\n  \"address\": \"0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5\",\n  \"sessionPublicKey\": \"3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29\",\n  \"clientId\": \"monaco-frontend\",\n  \"chainId\": \"1328\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://staging.apimonaco.xyz/api/v1/auth/challenge")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"address\": \"0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5\",\n  \"sessionPublicKey\": \"3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29\",\n  \"clientId\": \"monaco-frontend\",\n  \"chainId\": \"1328\"\n}"

response = http.request(request)
puts response.read_body

{
  "nonce": "abc123def456",
  "message": "Sign this message to authenticate with Monaco Protocol...",
  "expiresAt": 1699876543
}

Body

application/json

address

string

required

Ethereum wallet address

Required string length: 42

Pattern: ^0x[0-9a-fA-F]{40}$

Example:

"0x742d35Cc6634C0532925a3b8D4060f31E2C3d8B5"

sessionPublicKey

string

required

Lowercase hex (64 chars) ed25519 public key generated locally by the SDK. The returned challenge message will embed this key so the wallet's signature binds it; the same value must be submitted to /api/v1/auth/verify.

Required string length: 64

Pattern: ^[0-9a-f]{64}$

Example:

"3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29"

clientId

string | null

Optional application identifier

Example:

"monaco-frontend"

chainId

string | null

Optional chain ID supplied by SDK clients

Example:

"1328"

Response

nonce

string | null

Unique challenge nonce

Example:

"abc123def456"

message

string | null

Message to sign

Example:

"Sign this message to authenticate with Monaco Protocol..."

expiresAt

integer<int32> | null

Unix timestamp when challenge expires

Example:

1699876543

Learn

Build

Libraries

APIs

Resources

Create authentication challenge

Body

Response