siwa-server-side

To prevent replay attacks during API authentication, you can issue per-agent nonces for SIWA message signing. This server-side flow validates signed messages and generates tamper-evident receipts before granting access to protected endpoints.

Yes, SIWA server-side verification works with Express, Next.js, Hono, and Fastify. The integration protects API routes by verifying agent signatures and issuing receipts within these supported frameworks.

To verify agent identities on the server, you need a Viem RPC client and a secure receipt secret. These components perform onchain checks and generate HMAC receipts for valid SIWA signatures.

You issue nonces for SIWA message signing through the server-side verification flow. This process issues and manages nonces per agent, ensuring each signed message is validated before generating an ERC-8128 receipt.

You need a receipt secret to generate HMAC receipts during server-side SIWA verification. This creates tamper-evident receipts that prove agent identity and authorize subsequent requests to protected API endpoints.

The best way to protect API routes using SIWA signatures is implementing a server-side flow with nonce issuance and ERC-8128 receipt generation. This validates agents and prevents unauthorized access across Next.js, Express, Hono, and Fastify.