Wallet Auth

Wallet Auth lets people and AI agents sign in to Drupal with a crypto wallet instead of an email and a password. The wallet is the identity: one account can hold several wallets, and an agent signs in exactly like a person does, in code.

It implements Sign-In With Ethereum (EIP-4361): the site hands out a one-time nonce, the wallet signs a standard message, and Drupal recovers the address and opens the account that holds it, or creates one.

Features

• Sign in with a wallet on the login form: MetaMask or any EIP-1193 browser wallet.
• Agents are first-class users: a small JSON API (/wallet/nonce, /wallet/login) and a ready-made script (scripts/sign-in.mjs, with viem) let a bot or AI agent sign in with its key and get a normal Drupal session.
• Several wallets per account: link more from the account's edit form, which lists them. A wallet belongs to one account only.
• One address, every EVM chain: Ethereum, Arc, Base, Polygon… share the same address.
• No email needed: new accounts are named by the address.
• Follows the site's registration setting: Administrators only creates no accounts, Visitors, but administrator approval is required creates them blocked.

Use cases

• Marketplaces and paywalls where buyers pay with a wallet and their purchases should attach to an account.
• APIs used by AI agents, where an email and password make no sense.
• Web3 communities that want sign-in without collecting personal data.

How it works

1. GET /wallet/nonce returns {nonce, domain, uri}. The nonce works once, for 5 minutes.
2. The wallet signs an EIP-4361 message built with them (personal_sign).
3. POST /wallet/login with {"message", "signature"} as JSON: Drupal recovers the signer and answers {uid, name, address} with the session
   cookie.
4. Signed in, POST /wallet/link (same body, plus X-CSRF-Token from /session/token) adds another wallet to the account.

Requests are refused with a 403 and the reason when the message names another site, the nonce is used or unknown, the message has expired, or the signature comes from another address.

Post-installation

Enable the module: the Sign in with a wallet button appears on the login form and Link a wallet on the user edit form. Review Configuration → People → Account
settings → Who can register accounts?, which decides whether a new wallet c

Agents: WALLET_KEY=0x… node scripts/sign-in.mjs https://your-site signs in and prints the account and the cookie to send from then on.

Additional requirements

• Drupal 11.1+ or 12, PHP 8.3+ with the gmp extension.
• kornrunner/keccak and kornrunner/secp256k1, installed by Composer. Signature recovery runs in PHP; no external service is called.

Recommended modules

• x402 Pay: charge forin USDC over HTTP 402 (x402), paid by people or agents. With Wallet Auth,purchases and prices can attach to an account.

Similar projects

• SIWE Login also implemenWalletConnect and optional email verification. Wallet Auth focuses on AI agentsas users (JSON API and script), several wallets per account and email-free accounts.

Known limits

• EVM wallets with plain (EOA) signatures only. Smart-contract wallets (ERC-1271) and Solana are planned.
• Beta: routes and API may change before 1.0.0.

Background

Built for Ombú, an open-source marketplace on Drupal where AI agents sell to people and to other agents, paid in USDC on Arc. Development happens on GitHub; issues are welcome here on drupal.org.