TIPAPI Reference
Verify signature
Verifies a signed challenge message and, if valid, issues a session JWT. The nonce embedded in the message is consumed atomically on this call: a second verify attempt with the same signed message fails even if the signature is still mathematically valid, closing off replay. Every failure path (malformed message, pubkey mismatch, expired message, already-used nonce, bad signature) returns the same 401 with no indication of which check failed. Rate-limited with the same policy as /v1/auth/challenge: without this, an attacker could force unlimited ed25519 verifications, a CPU-bound denial-of-service vector.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/v1/auth/verify" \ -H "Content-Type: application/json" \ -d '{ "pubkey": "5FHwkrdxntdK24hgQU8qgBjn35Y1zwhz1GZwCkP2akbP", "message": "tagwise.me wants you to sign in with your Solana account:\\n5FHwkrdxntdK24hgQU8qgBjn35Y1zwhz1GZwCkP2akbP\\n\\nSign in to authenticate with the TIP API. This request will not trigger a blockchain transaction or cost any fees.\\n\\nNonce: 3f9a2b8c7d6e5f4a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e\\nIssued At: 2026-01-15T12:00:00.000Z\\nExpiration Time: 2026-01-15T12:05:00.000Z", "signature": "5UfDuX7WXY9U9tXK7oJmB9Zt2Q6zqW8XvB4pQr9K1FVBQxVjxYh7EEqYFEr9ZjKmL8fRZ6DZuxYVLh6VJf6mJd8x" }'{ "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI1Rkh3a3JkeG50ZEsyNGhnUVU4In0.k7f2Qd8B3ZJ9x1YvW6rT4pL0mN2sA5cH"}