> For the complete documentation index, see [llms.txt](https://noiho.gitbook.io/noiho/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://noiho.gitbook.io/noiho/developers/api-consumers/wallet-authentication.md).

# Wallet authentication and partner access

Use EOA signatures for order authorization and short-lived sessions for private access.

When public access is enabled, capabilities, quotes, signed creation and sanitized on-chain status need no provisioned partner token. Order creation still requires a valid wallet signature. EOA personal\_sign is supported; EIP-1271 and relayed contract callers are not.

1. POST /v1/auth/challenge with { walletAddress }.
2. Sign the exact returned message with that wallet using personal\_sign.
3. POST /v1/auth/session with { challengeId, signature }.
4. Use Authorization: Bearer for owned-order requests.
5. POST /v1/auth/logout to revoke the session.

A challenge is single-use and lasts five minutes. It binds the deployment chain and contract. A session lasts one hour. Its signature is separate from quote authorization and from refund-review authorization.

| Operation                            | Credential                                                        |
| ------------------------------------ | ----------------------------------------------------------------- |
| Owned status and transaction binding | Owner wallet session or authorized backend partner token.         |
| Deposit resume                       | Owner wallet session only.                                        |
| Refund review                        | Owned-order credential plus a separate original-wallet signature. |
| Session logout                       | Wallet session.                                                   |

Wallet owners can access their own orders, including partner-created orders. Keep session tokens in memory and never log them. Optional partner tokens remain backend-only. Invalid or expired bearer credentials return 401; do not fall back to anonymous access.