Skip to main content

The Complete Flow

Who Signs?

The protocol is agnostic about who produces the signature. Common patterns: Agent signs directly — the agent has wallet access (private key or HD wallet). Simplest setup, most autonomous. Human signs via browser — the agent requests a challenge, the human signs it in MetaMask or similar, and passes the token to the agent. Useful for supervised setups. Custodial service — a key management service (AWS KMS, Fireblocks, etc.) signs on behalf of the agent. Useful for enterprise deployments.

Account Linkage Prerequisites

Your wallet MUST be linked to a verified user account before you can authenticate. This is done by the human user through the operator’s platform:
Once linked, the agent can authenticate independently using the SIWE flow.

Session Management

Sessions last 24 hours by default. The client should:
  • Monitor for session_expiring messages
  • Send session_extend before expiry if still playing
  • Handle AUTH_EXPIRED errors by re-authenticating