Implement Secure Web3 Authentication

Web3 Authentication Expert provides expert guidance on implementing secure Web3 authentication systems using wallet connections, signature verification, and decentralized identity patterns, specializing in wallet-based authentication, cryptographic security, and patterns across different blockchain networks and wallet providers. Web3 authentication relies on cryptographic signatures rather than passwords: a user proves ownership of a wallet by signing a message with their private key. It documents three message-signing standards - EIP-191 (the Ethereum Signed Message standard), EIP-712 (typed structured data hashing and signing), and SIWE, Sign-In with Ethereum, an RFC-compliant authentication standard - and states core security fundamentals up front: never request private keys or seed phrases, use nonces to prevent replay attacks, implement proper signature verification, and validate wallet ownership through message signing rather than any other credential.

Use it to implement wallet-based login: MetaMask connection via window.ethereum with account and chain-ID requests, multi-wallet support through connector abstractions like WalletConnect and injected-wallet connectors scoped to specific chain IDs, EIP-191 message signing and server-side signature verification with ethers.js, EIP-712 typed-data signing with a domain, type schema, and value object, a full SIWE flow (server-issued nonce, client-side message creation and signing, server-side verification and JWT issuance), cryptographically secure nonce generation and storage with expiration (a Redis example), JWT-based session middleware, multi-chain configuration and validation against an allow-list of chain IDs, wallet-error-code handling (user rejection, pending request, unsupported network), and programmatic network switching or chain-adding via wallet_switchEthereumChain/wallet_addEthereumChain. It is specific to EVM-compatible wallet authentication (Ethereum and EVM sidechains/L2s) - not a general OAuth or password-based authentication guide, and it explicitly warns against ever requesting a private key or seed phrase as part of the flow.

Input is a Web3 authentication requirement - which wallets to support, which chains, and whether SIWE compliance is needed. Output is working JavaScript/TypeScript code: a wallet-connection function, connector configuration for multiple wallet providers, client-side signing plus server-side signature-verification functions for EIP-191 and EIP-712, a complete SIWE frontend and backend flow issuing a JWT on successful verification, nonce generation/storage/validation functions, JWT-based auth middleware, a chain-configuration map with validation, user-facing error messages mapped from wallet error codes, and a network-switching function that falls back to adding an unrecognized chain.

import { SiweMessage } from 'siwe';
import jwt from 'jsonwebtoken';

const verifyAuth = async (req, res) => {
  try {
    const { message, signature } = req.body;
    const siweMessage = new SiweMessage(message);
    
    // Verify signature and message validity
    const fields = await siweMessage.validate(signature);
    
    // Check nonce (prevent replay attacks)
    const isValidNonce = await validateNonce(fields.nonce);
    if (!isValidNonce) {
      return res.status(400).json({ error: 'Invalid nonce' });
    }
    
    // Generate JWT token
    const token = jwt.sign(
      { address: fields.address, chainId: fields.chainId },
      process.env.JWT_SECRET,
      { expiresIn: '24h' }
    );
    
    res.json({ token, user: { address: fields.address } });
  } catch (error) {
    res.status(401).json({ error: 'Authentication failed' });
  }
};

Documented libraries include ethers.js for signing and signature verification, the siwe package for Sign-In with Ethereum, @web3-react/injected-connector and @web3-react/walletconnect-connector for multi-wallet support, jsonwebtoken for session tokens, and Redis for nonce storage with expiration. Chain configuration is shown for Ethereum, BSC, Polygon, and Avalanche via their public RPC endpoints.

Web3 and dApp developers implementing wallet-based login who need signature-verification, SIWE compliance, multi-wallet and multi-chain support, and secure nonce/session handling, rather than assembling Web3 authentication from scratch or skipping replay-attack protection.