Authentication & wallets
https://docs.hazbase.com/en/guides/authentication/

IMPLEMENTATION GUIDE
 Authentication & wallets
 Sign-in, wallet ownership verification and operation approval serve different purposes. Treat the application session and operation authorization as distinct steps.
 Authentication and authorization flow
 01 Email OTP Application sign-in

 02 Passkey Device and high-trust authentication

 03 Account Account lookup / bootstrap

 04 Authorization Purpose-bound operation approval

 Email OTP creates an application session. It does not by itself prove wallet ownership or authorize a transfer.

 Start an application session
 sign-in.ts 
 1
2
3
4
5
6
7
8
9
 import { requestEmailOtp , verifyEmailOtp } from "@hazbase/auth" ; 

 export async function requestCode ( email : string ) { 
 return requestEmailOtp ( { email , purpose : "smart_wallet_sign_in" } ) ; 
 } 

 export async function verifyCode ( email : string , code : string ) { 
 return verifyEmailOtp ( { email , code , purpose : "smart_wallet_sign_in" } ) ; 
 } 

 Pass email and code from user input. Configure session storage and refresh, allowed origins and passkey behavior for your application.

 Before write operations
 emailSession is the application session sent in the Bearer header.
 Obtain deviceBindingId and highTrustToken through the user authentication flow; fixed sample values are not substitutes.
 High-trust tokens are purpose-bound and expire. Reauthenticate for the intended operation when necessary.
 Complete server verification of the signed wallet-link proof. A received address alone is not identity evidence.

 Authentication SDK guide Functions & types