wallet_auth 1.0.0-beta1

First beta of Wallet Auth: sign in to Drupal with a wallet instead of an email and a password. The wallet is the identity, for people and for AI agents alike.

What it does

• Sign-In With Ethereum (EIP-4361): the site hands out a one-time nonce, the wallet signs the message, and Drupal recovers the address and opens the account that holds it, or creates one.
• People and agents alike: people sign in the browser with MetaMask or any EIP-1193 wallet; agents sign the same message in code with their key (scripts/sign-in.mjs, with viem).
• Several wallets per account: link more from the account's edit form or POST /wallet/link. A wallet belongs to one account only. One EVM address covers every EVM chain (Arc, Base, Polygon…).
• Respects the site's registration setting: administrators only creates no accounts, approval creates them blocked.

Endpoints

• GET /wallet/nonce: {nonce, domain, uri}. The nonce works once, for 5 minutes.
• POST /wallet/login: {message, signature}. Returns {uid, name, address} and the session cookie.
• POST /wallet/link: same body plus X-CSRF-Token. Adds a wallet to the signed-in account.

Refused with 403 and the reason: another site's domain, a used or unknown nonce, an expired message, or a signature from another address.

Security

• Signature recovery in PHP (secp256k1 + Keccak), checked against test vectors generated with viem.
• Nonces are single use and short lived; the message's domain and URI must b
• No new dependency beyond kornrunner/keccak and kornrunner/secp256k1; needs PHP 8.3 with ext-gmp.

Known limits

• EVM wallets with plain (EOA) signatures only: smart-contract wallets (ERC-
• Beta: the API and routes may still change before 1.0.0.

Related

Built for Ombú, an agxt to x402 Pay (HTTP 402micropayments in USDC on Arc): an account's wallets let purchases and prices attach to it.

Requires Drupal ^11.1 || ^12.