Authentication & wallets

Authentication and authorization flow

Email OTP creates an application session. It does not by itself prove wallet ownership or authorize a transfer.

Start an application session

1
2
3
4
5
6
7
8
9

import { requestEmailOtp, verifyEmailOtp } from "@hazbase/auth";

export async function requestCode(email: string) {
  return requestEmailOtp({ email, purpose: "smart_wallet_sign_in" });
}

export async function verifyCode(email: string, code: string) {
  return verifyEmailOtp({ email, code, purpose: "smart_wallet_sign_in" });
}

Pass email and code from user input. Configure session storage and refresh, allowed origins and passkey behavior for your application.

Before write operations

• emailSession is the application session sent in the Bearer header.
• Obtain deviceBindingId and highTrustToken through the user authentication flow; fixed sample values are not substitutes.
• High-trust tokens are purpose-bound and expire. Reauthenticate for the intended operation when necessary.
• Complete server verification of the signed wallet-link proof. A received address alone is not identity evidence.