0

I'm using ethers to allow users to connect my dapp with their wallet on my website. Once they've connected their wallet I want the website to make an authenticated API request to a restricted API that I am developing.

Since the user has already authenticated with their wallet, I'd like to avoid having them sign up with an additional username and password in order to access the restricted API.

Is it possible to grant API access using only information from the connected wallet, or is a typical web2 username/password registration still required?

Improve this question

1 Answer 1

Reset to default
0

Sadly, I don't know much about traditional web2 user authentication myself. I can tell you this much however:

What you describe as the user "connecting with their wallet" is probably just a simple eth rpc request to a free-floating variable attached to window (window.ethereum). This is by no means safe and does not count as authentication (there are simple examples to "spoof" this). What you'll have to do is to send a request to the client to authenticate via a signature (have them sign some kind of message that includes a timestamp). On your server you must then validate the signature. If you want a simple solution, there are services like Moralis that aim to simplify this process.

Improve this answer
1
  • Thanks for the explanation. I'll get more familiar with signing, that sounds like the correct path for this.
    – Growth Mindset
    Jun 19, 2022 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.