Authenticate User with Signed Data

POST

auth

authenticate

Authenticate user with signed data

curl --request POST \
  --url https://1click.chaindefuser.com/v0/auth/authenticate \
  --header 'Content-Type: application/json' \
  --data '
{
  "signedData": {
    "payload": {
      "message": "<string>",
      "nonce": "<string>",
      "recipient": "<string>",
      "callbackUrl": "<string>"
    },
    "public_key": "<string>",
    "signature": "<string>",
    "standard": "nep413"
  }
}
'

import requests

url = "https://1click.chaindefuser.com/v0/auth/authenticate"

payload = { "signedData": {
        "payload": {
            "message": "<string>",
            "nonce": "<string>",
            "recipient": "<string>",
            "callbackUrl": "<string>"
        },
        "public_key": "<string>",
        "signature": "<string>",
        "standard": "nep413"
    } }
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    signedData: {
      payload: {
        message: '<string>',
        nonce: '<string>',
        recipient: '<string>',
        callbackUrl: '<string>'
      },
      public_key: '<string>',
      signature: '<string>',
      standard: 'nep413'
    }
  })
};

fetch('https://1click.chaindefuser.com/v0/auth/authenticate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://1click.chaindefuser.com/v0/auth/authenticate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'signedData' => [
        'payload' => [
                'message' => '<string>',
                'nonce' => '<string>',
                'recipient' => '<string>',
                'callbackUrl' => '<string>'
        ],
        'public_key' => '<string>',
        'signature' => '<string>',
        'standard' => 'nep413'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://1click.chaindefuser.com/v0/auth/authenticate"

	payload := strings.NewReader("{\n  \"signedData\": {\n    \"payload\": {\n      \"message\": \"<string>\",\n      \"nonce\": \"<string>\",\n      \"recipient\": \"<string>\",\n      \"callbackUrl\": \"<string>\"\n    },\n    \"public_key\": \"<string>\",\n    \"signature\": \"<string>\",\n    \"standard\": \"nep413\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://1click.chaindefuser.com/v0/auth/authenticate")
  .header("Content-Type", "application/json")
  .body("{\n  \"signedData\": {\n    \"payload\": {\n      \"message\": \"<string>\",\n      \"nonce\": \"<string>\",\n      \"recipient\": \"<string>\",\n      \"callbackUrl\": \"<string>\"\n    },\n    \"public_key\": \"<string>\",\n    \"signature\": \"<string>\",\n    \"standard\": \"nep413\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://1click.chaindefuser.com/v0/auth/authenticate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"signedData\": {\n    \"payload\": {\n      \"message\": \"<string>\",\n      \"nonce\": \"<string>\",\n      \"recipient\": \"<string>\",\n      \"callbackUrl\": \"<string>\"\n    },\n    \"public_key\": \"<string>\",\n    \"signature\": \"<string>\",\n    \"standard\": \"nep413\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "accessToken": "<string>",
  "refreshToken": "<string>",
  "expiresIn": 123,
  "refreshExpiresIn": 123
}

Send this endpoint a signed message from your user, and you’ll get back a User-Session token. That token is what lets the user’s confidential balances and transaction history (GET /v0/account/balances, GET /v0/account/history) be revealed. It’s separate from your Partner JWT, which authenticates your integration, not an individual user.

This is part of Confidential Intents. See Authenticating end users for the full guide.

Getting a signature to send

Your user’s NEAR wallet produces public_key and signature. The steps:

Build a NEP-413 payload: recipient set to "intents.near", a fresh random nonce, and message set to a stringified JSON object with an empty intents array plus a deadline and the user’s signer_id. The empty intents array is what makes this a proof of ownership instead of a real swap.
Have the user’s wallet sign that payload. The wallet returns the publicKey that signed it and the resulting signature, both prefixed ed25519:.
Send payload, public_key, and signature together as signedData on this endpoint.

If you’re on @defuse-protocol/intents-sdk, createIntentSignerNEP413 and buildAndSign() do steps 1 and 2 for you, that’s what the TypeScript SDK example below uses.

Example request

curl -X POST https://1click.chaindefuser.com/v0/auth/authenticate \
  -H "Content-Type: application/json" \
  -d '{
    "signedData": {
      "standard": "nep413",
      "payload": {
        "recipient": "intents.near",
        "nonce": "Vij2xgAlKBKzAEiS6N1S/hfrNi8/We0ieTmcMBti1YE=",
        "message": "{\"deadline\":\"2026-07-16T12:00:00.000Z\",\"intents\":[],\"signer_id\":\"your-account.near\"}"
      },
      "public_key": "ed25519:YOUR_PUBLIC_KEY",
      "signature": "ed25519:YOUR_SIGNATURE"
    }
  }'

const response = await fetch('https://1click.chaindefuser.com/v0/auth/authenticate', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    signedData: {
      standard: 'nep413',
      payload: {
        recipient: 'intents.near',
        nonce: 'Vij2xgAlKBKzAEiS6N1S/hfrNi8/We0ieTmcMBti1YE=',
        message: JSON.stringify({
          deadline: '2026-07-16T12:00:00.000Z',
          intents: [],
          signer_id: 'your-account.near'
        })
      },
      public_key: 'ed25519:YOUR_PUBLIC_KEY',
      signature: 'ed25519:YOUR_SIGNATURE'
    }
  })
});

const auth = await response.json();

import { createIntentSignerNEP413, IntentsSDK } from '@defuse-protocol/intents-sdk';
import { UserAuthService } from '@defuse-protocol/one-click-sdk-typescript';

// Step 1 + 2: wire up a signer backed by the user's wallet
const signer = createIntentSignerNEP413({
  accountId: userAccountId,
  signMessage: async (_payload, hash) => {
    const { publicKey, signature } = await userWallet.signMessage(hash);
    return { publicKey: publicKey.toString(), signature: Buffer.from(signature).toString('base64') };
  },
});

// Build a payload with an empty intents array (just a signature, not a real swap) and sign it
const sdk = new IntentsSDK({ referral: 'your-integration', env: 'production' });
const { signed } = await sdk
  .intentBuilder()
  .setDeadline(new Date(Date.now() + 5 * 60_000))
  .buildAndSign(signer);

// Step 3: exchange the signed payload for a User-Session token
const auth = await UserAuthService.authenticate({ signedData: signed });
// auth.accessToken, auth.refreshToken, auth.expiresIn, auth.refreshExpiresIn

Example response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 3600,
  "refreshExpiresIn": 2592000
}

signedData is the same MultiPayload signed-message format used for Signing Intents, signed here with an empty intents array. It’s used purely as proof of account ownership, not a real swap.

Store refreshToken securely. Anyone holding it can mint new accessTokens for this account until it expires.

Body

application/json

signedData

object

required

Assuming wallets want to interact with Intents protocol, besides preparing the data in a certain form, they have to have the capability to sign raw messages (off-chain signatures) using an algorithm we understand. This enum solves that problem.

For example, because we support ERC-191 and know how to verify messages with that standard, we can allow wallets, like Metamask, sign messages to perform intents without having to support new cryptographic primitives and signing standards.

Show child attributes

Response

accessToken

string

required

JWT access token for API calls

refreshToken

string

required

JWT refresh token for getting new access tokens

expiresIn

number

required

Access token expiration time in seconds

refreshExpiresIn

number

required

Refresh token expiration time in seconds

Refresh Access TokenExchange a refresh token for a new access token

⌘I

Authenticate user with signed data

curl --request POST \
  --url https://1click.chaindefuser.com/v0/auth/authenticate \
  --header 'Content-Type: application/json' \
  --data '
{
  "signedData": {
    "payload": {
      "message": "<string>",
      "nonce": "<string>",
      "recipient": "<string>",
      "callbackUrl": "<string>"
    },
    "public_key": "<string>",
    "signature": "<string>",
    "standard": "nep413"
  }
}
'

import requests

url = "https://1click.chaindefuser.com/v0/auth/authenticate"

payload = { "signedData": {
        "payload": {
            "message": "<string>",
            "nonce": "<string>",
            "recipient": "<string>",
            "callbackUrl": "<string>"
        },
        "public_key": "<string>",
        "signature": "<string>",
        "standard": "nep413"
    } }
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    signedData: {
      payload: {
        message: '<string>',
        nonce: '<string>',
        recipient: '<string>',
        callbackUrl: '<string>'
      },
      public_key: '<string>',
      signature: '<string>',
      standard: 'nep413'
    }
  })
};

fetch('https://1click.chaindefuser.com/v0/auth/authenticate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://1click.chaindefuser.com/v0/auth/authenticate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'signedData' => [
        'payload' => [
                'message' => '<string>',
                'nonce' => '<string>',
                'recipient' => '<string>',
                'callbackUrl' => '<string>'
        ],
        'public_key' => '<string>',
        'signature' => '<string>',
        'standard' => 'nep413'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://1click.chaindefuser.com/v0/auth/authenticate"

	payload := strings.NewReader("{\n  \"signedData\": {\n    \"payload\": {\n      \"message\": \"<string>\",\n      \"nonce\": \"<string>\",\n      \"recipient\": \"<string>\",\n      \"callbackUrl\": \"<string>\"\n    },\n    \"public_key\": \"<string>\",\n    \"signature\": \"<string>\",\n    \"standard\": \"nep413\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://1click.chaindefuser.com/v0/auth/authenticate")
  .header("Content-Type", "application/json")
  .body("{\n  \"signedData\": {\n    \"payload\": {\n      \"message\": \"<string>\",\n      \"nonce\": \"<string>\",\n      \"recipient\": \"<string>\",\n      \"callbackUrl\": \"<string>\"\n    },\n    \"public_key\": \"<string>\",\n    \"signature\": \"<string>\",\n    \"standard\": \"nep413\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://1click.chaindefuser.com/v0/auth/authenticate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"signedData\": {\n    \"payload\": {\n      \"message\": \"<string>\",\n      \"nonce\": \"<string>\",\n      \"recipient\": \"<string>\",\n      \"callbackUrl\": \"<string>\"\n    },\n    \"public_key\": \"<string>\",\n    \"signature\": \"<string>\",\n    \"standard\": \"nep413\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "accessToken": "<string>",
  "refreshToken": "<string>",
  "expiresIn": 123,
  "refreshExpiresIn": 123
}

Intents

Swap API

Developer ToolKit

Resources

Authenticate User with Signed Data

Getting a signature to send

Example request

Example response

Body

Response

​Getting a signature to send

​Example request

​Example response

Body

Response

Getting a signature to send

Example request

Example response