Wallet Auth & Passkeys

Wallet-first identity

Aegis has no email field and no password. Your identity is your wallet. You prove ownership by signing a challenge, and that signature — not a stored secret — grants you a session. There is nothing to leak because there is no password to steal.

Sign-In With Ethereum (SIWE)

Authentication follows the Sign-In With Ethereum standard (EIP-4361). When you connect, Aegis presents a structured, human-readable message that names the domain, your address, a nonce, and a timestamp. You sign it in your wallet, and Aegis verifies the signature server-side before issuing a session.

The nonce makes each challenge single-use, so a captured signature cannot be replayed to open a new session.

Signature verification

Aegis verifies signatures for the chains it supports:

• EVM chains — secp256k1 signature recovery against your address.
• Solana — ed25519 signature verification against your public key.

Verification happens on the Trading Core; the browser never decides whether a signature is valid.

CAIP-10 multi-wallet

Wallets are identified using CAIP-10 account identifiers, so a single Aegis account can link several wallets across EVM chains and Solana. Any verified wallet on the account can be used to sign in — and any verified wallet can be used to recover the account. See Step-up signatures for how recovery is gated.

Passkeys (WebAuthn)

Aegis supports passkeys built on WebAuthn. A discoverable passkey lets you log in without first selecting a wallet, and serves as a recovery factor bound to your device's secure hardware. Passkeys never leave the authenticator, and Aegis only ever sees the public key.

Optional social login

If you prefer not to manage a browser extension, an optional social login with an embedded wallet is available via Privy. It still produces a real wallet you control — Aegis remains wallet-first and non-custodial.