> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agg.market/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify a wallet signature or a Privy access token

> Proves identity and returns an access + refresh token pair directly. The body is a union on `kind`:

- **wallet** (default when `kind` is omitted) — verifies a signed SIWE/SIWS `message` and `signature`.
- **`kind: "privy"`** — verifies a Privy-issued ES256 access token against the app's Privy JWKS. Available only when the app's wallet provider is Privy with credentials saved; the token must be issued by that same Privy app. Otherwise, or when the token is expired or invalid, the request is rejected with 401.

Everything after identity is proven is shared across both: principal creation, the early-access gate, user creation, and token issuing.



## OpenAPI

````yaml /openapi/openapi.json post /auth/verify
openapi: 3.0.2
info:
  title: AGG API
  version: 1.0.0
  description: >-
    Prediction market aggregator REST API — authentication, users, venue events,
    venue markets, orderbooks, charts, and execution workflows.
servers:
  - url: https://api.agg.market
    description: Production
  - url: https://api.staging.agg.market
    description: Staging
security: []
paths:
  /auth/verify:
    post:
      tags:
        - Authentication
      summary: Verify a wallet signature or a Privy access token
      description: >-
        Proves identity and returns an access + refresh token pair directly. The
        body is a union on `kind`:


        - **wallet** (default when `kind` is omitted) — verifies a signed
        SIWE/SIWS `message` and `signature`.

        - **`kind: "privy"`** — verifies a Privy-issued ES256 access token
        against the app's Privy JWKS. Available only when the app's wallet
        provider is Privy with credentials saved; the token must be issued by
        that same Privy app. Otherwise, or when the token is expired or invalid,
        the request is rejected with 401.


        Everything after identity is proven is shared across both: principal
        creation, the early-access gate, user creation, and token issuing.
      operationId: verify
      requestBody:
        required: true
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  required:
                    - message
                    - signature
                  properties:
                    kind:
                      type: string
                      enum:
                        - wallet
                    message:
                      type: string
                    signature:
                      type: string
                    earlyAccessCode:
                      type: string
                - type: object
                  required:
                    - kind
                    - privyToken
                  properties:
                    kind:
                      type: string
                      enum:
                        - privy
                    privyToken:
                      minLength: 1
                      type: string
                    earlyAccessCode:
                      type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              schema:
                type: object
                required:
                  - accessToken
                  - user
                properties:
                  accessToken:
                    type: string
                  refreshToken:
                    type: string
                  user:
                    type: object
                    required:
                      - id
                    properties:
                      id:
                        type: string
        '400':
          description: '400'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '401':
          description: '401'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '403':
          description: '403'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
      security:
        - appId: []
components:
  securitySchemes:
    appId:
      type: apiKey
      in: header
      name: x-app-id
      description: Your application ID. Required for all app-tier and user-tier routes.

````