Skip to main content

Wallet Authentication

This section covers blockchain wallet-based authentication operations available in the GraphQL Main API. The API supports authentication using blockchain wallets, allowing users to sign messages to prove ownership of their wallets.

Important Note: WalletConnect sign-up functionality has been deprecated. New users cannot register using WalletConnect. Existing users who previously signed up with WalletConnect can still sign in, but they will be prompted to upgrade their authentication method to email, Google, or Meta.

Deprecated Sign-in Method​

WalletConnect authentication is now considered a deprecated sign-in method. The following rules apply:

  • New user registration via WalletConnect is no longer supported
  • Existing users can still sign in using WalletConnect as an initial step
  • After signing in with WalletConnect, users will be prompted to connect their account to Google, Meta, or provide an email
  • Once a user has associated their account with email, Google, or Meta, they can no longer use WalletConnect to sign in
  • The system will mark WalletConnect as a deprecated sign-in method after the user upgrades to a new authentication method

Mutations​

generateWalletAuthMessage​

Generate a message that needs to be signed by the wallet for authentication.

mutation GenerateWalletAuthMessage($input: GenerateWalletAuthMessageInput!) {
generateWalletAuthMessage(input: $input)
}

Input:

input GenerateWalletAuthMessageInput {
address: String! // The wallet address for authentication
fingerprint: String! // Device fingerprint for additional security
type: String // Optional type parameter for specific wallet authentication flow
isLedger: Boolean // Optional flag indicating if using a Ledger hardware wallet
}

Returns:

  • String: A message that should be signed by the wallet

Example Input:

mutation {
generateWalletAuthMessage(
input: {
address: "SoLW3mMFBWFXM8vKkdw1P2FCCPqJVuKxZKYAxz12e4US"
fingerprint: "device-fingerprint-123"
isLedger: false
}
)
}

Example Output:

{
"data": {
"generateWalletAuthMessage": "Welcome to BlockBet! Please sign this message to verify your wallet ownership. Nonce: 87654321. Time: 2023-12-25T12:34:56Z"
}
}

linkWallet​

Link a blockchain wallet to an existing user account.

mutation LinkWallet($input: LinkWalletInput!) {
linkWallet(input: $input) {
id
username
email
# other user fields
}
}

Input:

input LinkWalletInput {
address: String! // The wallet address to link
signature: String! // The signature proving ownership of the wallet
isLedger: Boolean // Flag indicating if using a Ledger hardware wallet
}

Returns:

  • UserModel: The updated user object after linking the wallet

Example Input:

mutation {
linkWallet(
input: {
address: "SoLW3mMFBWFXM8vKkdw1P2FCCPqJVuKxZKYAxz12e4US"
signature: "2UNjAuTSs4xv4rkMXgvbLpSjLdZYd2fDDVEfogbQrEXoNUBrB4ySfVpWjN7QFzezfWw9FZW3qP29AL3JHZqBdFHk"
isLedger: false
}
) {
id
username
email
}
}

Example Output:

{
"data": {
"linkWallet": {
"id": "user_12345abcde",
"username": "johndoe123",
"email": "johndoe@example.com"
}
}
}

unlinkWallet​

Unlink a blockchain wallet from a user account.

mutation UnlinkWallet($address: String!) {
unlinkWallet(address: $address) {
id
username
email
# other user fields
}
}

Arguments:

  • address (String!): The wallet address to unlink

Returns:

  • UserModel: The updated user object after unlinking the wallet

Example Input:

mutation {
unlinkWallet(address: "SoLW3mMFBWFXM8vKkdw1P2FCCPqJVuKxZKYAxz12e4US") {
id
username
email
}
}

Example Output:

{
"data": {
"unlinkWallet": {
"id": "user_12345abcde",
"username": "johndoe123",
"email": "johndoe@example.com"
}
}
}

Wallet Authentication Flow​

  1. Generate Authentication Message:

    • Call generateWalletAuthMessage with the wallet address and device fingerprint
    • Receive a unique message that needs to be signed
  2. Sign the Message:

    • Use the wallet to sign the generated message
    • This proves ownership of the private key associated with the wallet address
  3. Authenticate:

    • Use the wallet address, message, and signature in an authentication endpoint
    • The API verifies the signature and authenticates the user
  4. Link or Unlink Wallet (Optional):

    • Use linkWallet to connect a wallet to an existing account
    • Use unlinkWallet to remove a wallet connection

Security Considerations​

  • The message to be signed includes a timestamp and nonce to prevent replay attacks
  • The API verifies that the wallet address recovered from the signature matches the provided address
  • Always ensure that the signing process is done in a secure environment
  • The wallet linking process requires an already authenticated session
  • Device fingerprinting adds an additional layer of security
  • Special handling for hardware wallets like Ledger provides enhanced security