I'm following the moralis tutorial to build an authentication and authorization system with moralis and reactJS https://docs.moralis.io/authentication-api/evm/how-to-authenticate-users-with-metamask-using-react. I get this error when i hit this route http://localhost:4000/verify. The code that creates this error is the following:

const { address, profileId } = (
      await Moralis.Auth.verify({
        networkType: "evm",

This is the full code of the request:

const Moralis = require("moralis").default;

const express = require("express");
const cors = require("cors");
const cookieParser = require("cookie-parser");
const jwt = require("jsonwebtoken");

// to use our .env variables

const app = express();
const port = 4000;


// allow access to React app domain
    origin: "http://localhost:3000",
    credentials: true,

const config = {
  domain: process.env.APP_DOMAIN,
  statement: "Please sign this message to confirm your identity.",
  uri: process.env.REACT_URL,
  timeout: 60,

app.post("/verify", async (req, res) => {
  try {
    const { message, signature } = req.body;

    const { address, profileId } = (
      await Moralis.Auth.verify({
        networkType: "evm",

    const user = { address, profileId, signature };

    // create JWT token
    const token = jwt.sign(user, process.env.AUTH_SECRET);

    // set JWT cookie
    res.cookie("jwt", token, {
      httpOnly: true,

  } catch (error) {
    res.status(400).json({ error: error.message });

Full message error:

MoralisError [Moralis SDK Core Error]: [C0006] Request failed, Bad Request(400): Invalid message: {"success":false,"state":103,"length":277,"matched":0,"maxMatched":5,"maxTreeDepth":15,"nodeHits":184,"inputLength":277,"subBegin":0,"subEnd":277,"subLength":277}
    at RequestController.makeError (/Users/filippomeda/Desktop/dev/web3/income/Improver/server/node_modules/@moralisweb3/common-core/lib/cjs/index.cjs:1224:20)
    at RequestController.<anonymous> (/Users/filippomeda/Desktop/dev/web3/income/Improver/server/node_modules/@moralisweb3/common-core/lib/cjs/index.cjs:1205:38)
    at step (/Users/filippomeda/Desktop/dev/web3/income/Improver/server/node_modules/@moralisweb3/common-core/lib/cjs/index.cjs:83:23)
    at Object.throw (/Users/filippomeda/Desktop/dev/web3/income/Improver/server/node_modules/@moralisweb3/common-core/lib/cjs/index.cjs:64:53)
    at rejected (/Users/filippomeda/Desktop/dev/web3/income/Improver/server/node_modules/@moralisweb3/common-core/lib/cjs/index.cjs:55:65)
    at processTicksAndRejections (node:internal/process/task_queues:96:5) {
  isMoralisError: true,
  code: 'C0006',
  details: {
    status: 400,
    response: {
      status: 400,
      statusText: 'Bad Request',
      headers: [AxiosHeaders],
      config: [Object],
      request: [ClientRequest],
      data: [Object]
  [cause]: AxiosError: Request failed with status code 400
      at settle (/Users/filippomeda/Desktop/dev/web3/income/Improver/server/node_modules/axios/dist/node/axios.cjs:1909:12)
      at IncomingMessage.handleStreamEnd (/Users/filippomeda/Desktop/dev/web3/income/Improver/server/node_modules/axios/dist/node/axios.cjs:2989:11)
      at IncomingMessage.emit (node:events:539:35)
      at endReadableNT (node:internal/streams/readable:1345:12)
      at processTicksAndRejections (node:internal/process/task_queues:83:21) {
    code: 'ERR_BAD_REQUEST',
    config: {
      transitional: [Object],
      adapter: [Array],
      transformRequest: [Array],
      transformResponse: [Array],
      timeout: 20000,
      xsrfCookieName: 'XSRF-TOKEN',
      xsrfHeaderName: 'X-XSRF-TOKEN',
      maxContentLength: Infinity,
      maxBodyLength: Infinity,
      env: [Object],
      validateStatus: [Function: validateStatus],
      headers: [AxiosHeaders],
      method: 'post',
      url: 'https://authapi.moralis.io/challenge/verify/evm',
      params: {},
      data: '{"message":"http://localhost:3000 wants you to sign in with your Ethereum account:\\n0xa9B54220AD207Cf6fffb587493ff774c6d763706\\n\\nPlease sign this message to confirm your identity.\\n\\nURI: http://localhost:3000\\nVersion: 1\\nChain ID: 1\\nNonce: Qk1yAs9wQ9u1It47Q\\nIssued At: 2023-07-17T12:10:57.277Z","signature":"0x2a47b5edf79b27eab4638e8ac86696ab60628b43f4bf11f0323f697f8eeda384327c13cf6e94171552920f5043e062244a29e16b152bcc1dee8f91c53bd0030b1c"}'
    request: ClientRequest {
      _events: [Object: null prototype],
      _eventsCount: 7,
      _maxListeners: undefined,
      outputData: [],
      outputSize: 0,
      writable: true,
      destroyed: false,
      _last: true,
      chunkedEncoding: false,
      shouldKeepAlive: false,
      maxRequestsOnConnectionReached: false,
      _defaultKeepAlive: true,
      useChunkedEncodingByDefault: true,
      sendDate: false,
      _removedConnection: false,
      _removedContLen: false,
      _removedTE: false,
      _contentLength: null,
      _hasBody: true,
      _trailer: '',
      finished: true,
      _headerSent: true,
      _closed: false,
      socket: [TLSSocket],
      _header: 'POST /challenge/verify/evm HTTP/1.1\r\n' +
        'Accept: application/json, text/plain, */*\r\n' +
        'Content-Type: application/json\r\n' +
        'x-moralis-platform: NodeJS SDK\r\n' +
        'x-moralis-platform-version: 2.22.4\r\n' +
        'x-moralis-build-target: node\r\n' +
        'x-api-key:notsharingapukey\r\n' +
        'User-Agent: axios/1.4.0\r\n' +
        'Content-Length: 447\r\n' +
        'Accept-Encoding: gzip, compress, deflate, br\r\n' +
        'Host: authapi.moralis.io\r\n' +
        'Connection: close\r\n' +
      _keepAliveTimeout: 0,
      _onPendingData: [Function: nop],
      agent: [Agent],
      socketPath: undefined,
      method: 'POST',
      maxHeaderSize: undefined,
      insecureHTTPParser: undefined,
      path: '/challenge/verify/evm',
      _ended: true,
      res: [IncomingMessage],
      aborted: false,
      timeoutCb: null,
      upgradeOrConnect: false,
      parser: null,
      maxHeadersCount: null,
      reusedSocket: false,
      host: 'authapi.moralis.io',
      protocol: 'https:',
      _redirectable: [Writable],
      [Symbol(kCapture)]: false,
      [Symbol(kNeedDrain)]: false,
      [Symbol(corked)]: 0,
      [Symbol(kOutHeaders)]: [Object: null prototype]
    response: {
      status: 400,
      statusText: 'Bad Request',
      headers: [AxiosHeaders],
      config: [Object],
      request: [ClientRequest],
      data: [Object]

If you have any suggestion please let me know it.

  • Hi, Did you get any other error logs in your code editor console? More details about the error might help to debug further. Since the error happened at /verify a possible cause for the error can be incorrect message, signature params sent from frontend code.
    – JohnVersus
    Jul 17, 2023 at 10:46
  • 1
    i added the full error message to the question
    – Shadq
    Jul 17, 2023 at 12:02

1 Answer 1


The error here occurred due to the incorrect format of APP_DOMAIN variable. The accepted format is RFC 4501 dns authority format. So as an example, the APP_DOMAIN name should be like stackexchange.com for the website uri https://ethereum.stackexchange.com/.

Since you are on localhost the APP_DOMAIN will just localhost.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.