Verify a wallet signature or a Privy access token
curl --request POST \
--url https://api.agg.market/auth/verify \
--header 'Content-Type: application/json' \
--header 'x-app-id: <api-key>' \
--data '
{
"message": "<string>",
"signature": "<string>",
"kind": "wallet",
"earlyAccessCode": "<string>"
}
'import requests
url = "https://api.agg.market/auth/verify"
payload = {
"message": "<string>",
"signature": "<string>",
"kind": "wallet",
"earlyAccessCode": "<string>"
}
headers = {
"x-app-id": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-app-id': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
message: '<string>',
signature: '<string>',
kind: 'wallet',
earlyAccessCode: '<string>'
})
};
fetch('https://api.agg.market/auth/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.agg.market/auth/verify",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'message' => '<string>',
'signature' => '<string>',
'kind' => 'wallet',
'earlyAccessCode' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-app-id: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.agg.market/auth/verify"
payload := strings.NewReader("{\n \"message\": \"<string>\",\n \"signature\": \"<string>\",\n \"kind\": \"wallet\",\n \"earlyAccessCode\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-app-id", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.agg.market/auth/verify")
.header("x-app-id", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"message\": \"<string>\",\n \"signature\": \"<string>\",\n \"kind\": \"wallet\",\n \"earlyAccessCode\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.agg.market/auth/verify")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-app-id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"message\": \"<string>\",\n \"signature\": \"<string>\",\n \"kind\": \"wallet\",\n \"earlyAccessCode\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"accessToken": "<string>",
"user": {
"id": "<string>"
},
"refreshToken": "<string>"
}{
"message": "<string>"
}{
"message": "<string>"
}{
"message": "<string>"
}Authentication
Verify a wallet signature or a Privy access token
Proves identity and returns an access + refresh token pair directly. The body is a union on kind:
- wallet (default when
kindis omitted) — verifies a signed SIWE/SIWSmessageandsignature. kind: "privy"— verifies a Privy-issued ES256 access token against the app’s Privy JWKS. Available only when the app’s wallet provider is Privy with credentials saved; the token must be issued by that same Privy app. Otherwise, or when the token is expired or invalid, the request is rejected with 401.
Everything after identity is proven is shared across both: principal creation, the early-access gate, user creation, and token issuing.
POST
/
auth
/
verify
Verify a wallet signature or a Privy access token
curl --request POST \
--url https://api.agg.market/auth/verify \
--header 'Content-Type: application/json' \
--header 'x-app-id: <api-key>' \
--data '
{
"message": "<string>",
"signature": "<string>",
"kind": "wallet",
"earlyAccessCode": "<string>"
}
'import requests
url = "https://api.agg.market/auth/verify"
payload = {
"message": "<string>",
"signature": "<string>",
"kind": "wallet",
"earlyAccessCode": "<string>"
}
headers = {
"x-app-id": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-app-id': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
message: '<string>',
signature: '<string>',
kind: 'wallet',
earlyAccessCode: '<string>'
})
};
fetch('https://api.agg.market/auth/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.agg.market/auth/verify",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'message' => '<string>',
'signature' => '<string>',
'kind' => 'wallet',
'earlyAccessCode' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-app-id: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.agg.market/auth/verify"
payload := strings.NewReader("{\n \"message\": \"<string>\",\n \"signature\": \"<string>\",\n \"kind\": \"wallet\",\n \"earlyAccessCode\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-app-id", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.agg.market/auth/verify")
.header("x-app-id", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"message\": \"<string>\",\n \"signature\": \"<string>\",\n \"kind\": \"wallet\",\n \"earlyAccessCode\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.agg.market/auth/verify")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-app-id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"message\": \"<string>\",\n \"signature\": \"<string>\",\n \"kind\": \"wallet\",\n \"earlyAccessCode\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"accessToken": "<string>",
"user": {
"id": "<string>"
},
"refreshToken": "<string>"
}{
"message": "<string>"
}{
"message": "<string>"
}{
"message": "<string>"
}Authorizations
Your application ID. Required for all app-tier and user-tier routes.
Body
application/json