Authentication

Wallet login:

1. User connects wallet.

2. App asks to sign "Sign in to Qwery: <timestamp>" .

3. Backend verifies signature.

4. Issues JWT with wallet as subject.

5. Stores JWT in httpOnly cookie.

Facilitator:

• NO authentication required to call facilitator

• Facilitator is public service

• Rate limiting prevents abuse

Your Application:

• YOU implement user authentication

• Recommended: Wallet signature auth

• Store user sessions

• Protect your API routes

Example Wallet Auth:

import { useWallet } from '@solana/wallet-adapter-react';

const { publicKey, signMessage } = useWallet();

// Sign authentication message
const message = `Login to MyApp\nTimestamp: ${Date.now()}`;
const signature = await signMessage(new TextEncoder().encode(message));

// Verify signature on your backend
const verified = verifySignature(publicKey, message, signature);
if (verified) {
  // Issue JWT token
}