Sign-in

Publishing, the dashboard and history need a wallet session. Buying a press doesn't: the payment itself proves who you are.

A session is an HttpOnly cookie, valid for 30 days, tied to one wallet address. These endpoints work only from capitalpress.io.

1. Get a message to sign

POST /api/auth/nonce
{ "address": "0xYourWallet" }

{ "nonce": "…", "message": "capitalpress.io wants you to sign in to Capital Press with your wallet:\n0xYourWallet\n\nSign this message…\n\nNonce: …" }

The nonce is valid for ten minutes and can be used once.

2. Send the signature

Sign message exactly as given with personal_sign, then:

POST /api/auth/verify
{ "address": "0xYourWallet", "nonce": "…", "signature": "0x…" }

{ "address": "0xyourwallet" }

Smart-contract wallets are supported. A wrong signature or a reused nonce returns 401.

Who am I

GET /api/me

{ "address": "0xyourwallet" }

address is null when there's no session.

Sign out

POST /api/auth/logout