How authentication works
A signed challenge from your wallet, gated by biometrics — not a password.
PTERI authentication is challenge–response with a wallet signature, not a password or a FIDO2/WebAuthn credential.
The flow
- An app or service requests authentication
- PTERI's backend generates a challenge — a random, short-lived value
- The challenge reaches your wallet
- You approve via your device's biometrics
- The wallet signs the challenge with your private key
- The signature is sent back and verified against your known public key
- Once verified, the backend issues its own session — it never saw or handled your private key at any point
Because the key never leaves your device and each challenge is single-use, there's no reusable secret for a phishing page or a breached database to expose.
For developers
API requests authenticate with the nodeUrlOrApiAccessKey header — either your API access key (a JWT, sent raw with no Bearer prefix) or a dedicated node URL on Enterprise plans. Signing and verification are exposed directly as API operations: /api/Address/sign-message and /api/Address/verify-message. See getting started with the API for a working request sequence.