On my site I do not want to use email/pass authorization, but insteand I'd like to use Metamask sign functionality (it is impossible to work with site without Metamask or browser with web3).

I suppose to implement something like this:

  • client generates any random string/pin code.
  • on "login" click sign it and sends alongside with pincode to server (I know that I can use any static phrase and it doesn't increases overall security).
  • there signature checked and public key/address derived.
  • if user with such public key/address found - generate standard JWT and use it with all following REST requests.

I am wondering is it safe enough or I missed something important?

  • looking for similar I found this, not sure if quite what you need but helpful: hackernoon.com/…
    – majick
    Commented May 10, 2018 at 23:19
  • @majick thanks, I already implemented it and cannot see any security cons in this approach.
    – Alex G.P.
    Commented May 11, 2018 at 3:58
  • certainly looks like the way to go, any tips or code you can share? this is totally not my area of expertise (yet.)
    – majick
    Commented May 17, 2018 at 13:49

1 Answer 1


This has been done multiple times, but this is one that really goes into details on it


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.