Wallet Auth

Wallet Auth lets people and AI agents sign in to Drupal with a crypto wallet instead of an email and a password. The wallet is the identity: one account can hold several wallets, on Ethereum-compatible chains and on Solana, and an agent signs in exactly like a person does, in code.

It implements Sign-In With Ethereum (EIP-4361) and its Solana counterpart (SIWS, the same message): the site hands out a one-time nonce, the wallet signs a standard message, and Drupal checks the signer and opens the account that holds it, or creates one.

Features

• Sign in with a wallet on the login form: MetaMask or any EIP-1193 browser wallet, or Phantom, Solflare or Backpack on Solana. The wallet's account picker always opens before signing.
• Agents are first-class users: a small JSON API (/wallet/nonce, /wallet/login) lets a bot or AI agent sign in with its key and get a normal Drupal session.
• Several wallets per account: link more from the account's edit form. The account page lists them with their name, network and since when. A wallet belongs to one account only.
• Every EVM chain with one address (Ethereum, Arc, Base, Polygon…), and Solana.
• Unlinking for support: with Unlink wallets from any account, through a confirmation. Owners can unlink their own with a separate permission, granted to no role by default.
• Events: WalletEvent says which wallet signed in, was linked, was unlinked or was refused, for an audit trail, a notice or ECA.
• No email needed: new accounts are named by the address.
• Follows the site's registration setting: Administrators only creates no accounts, Visitors, but administrator approval is required creates them blocked.
• No external service, no Node.js: signatures are checked in PHP, tested against reference vectors.

Use cases

• Marketplaces and paywalls where buyers pay with a wallet and their purchases should attach to an account.
• APIs used by AI agents, where an email and password make no sense.
• Web3 communities that want sign-in without collecting personal data.

How it works

1. GET /wallet/nonce returns {nonce, domain, uri}. The nonce works once, for 5 minutes.
2. The wallet signs an EIP-4361 message built with them: personal_sign on EVM, signMessage (ed25519, base58 signature) on Solana.
3. POST /wallet/login with {"message", "signature"} as JSON: Drupal checks the signer and answers {uid, name, address} with the session cookie.
4. Signed in, POST /wallet/link (same body, plus X-CSRF-Token from /session/token) adds another wallet to the account.

Requests are refused with a 403 and the reason when the message names another site, the nonce is used or unknown, the message has expired, or the signature comes from another address.

Post-installation

Enable the module: Sign in with an Ethereum wallet and with a Solana wallet appear on the login form, and Link an Ethereum wallet and Link a Solana wallet on the user edit form. Review Configuration → People → Account settings → Who can register accounts?, which decides whether a new wallet creates an account. Grant the unlink permissions to support staff if needed.

After updating from 1.0.0-beta1, run drush updb: wallets get a name.

Additional requirements

• Drupal 11.1+ or 12, PHP 8.3+ with the gmp and sodium extensions.
• kornrunner/keccak and kornrunner/secp256k1, installed by Composer.

Recommended modules

• x402 Pay: charge in USDC over HTTP 402 (x402), paid by people or agents, on Arc and Solana. With Wallet Auth, purchases and prices can attach to an account.

Similar projects

• SIWE Login also implements Sign-In With Ethereum, with WalletConnect and optional email verification. Wallet Auth focuses on AI agents as users (a JSON API), Solana as well as EVM, several wallets per account and email-free accounts.

Known limits

• Plain wallet signatures only: smart-contract wallets (ERC-1271) are planned.
• Beta: routes and API may change before 1.0.0.

Background

Built for Ombú, an open-source marketplace on Drupal where AI agents sell to people and to other agents. Development happens on GitHub; issues are welcome here on drupal.org.