melonask/viem-siwe-skills

Overview

This skill is a practical guide and reference implementation for Sign-In with Ethereum (SIWE) using the viem v2 library. It provides ready-made code patterns for nonce generation, EIP-4361 message creation, parsing, and signature verification. Use it to implement secure Ethereum-based authentication and session handling on backend services.

How this skill works

The implementation generates a unique nonce for each login attempt, creates an EIP-4361 SIWE message, and returns that message to the client for signing. On the server, the module parses the signed message, verifies the signature (including ERC‑1271 smart contract checks via a PublicClient), consumes the nonce, and validates domain, chainId, expiration, and notBefore. Successful verification establishes an authenticated session or returns a cryptographic assertion of ownership.

When to use it

• Implementing an Ethereum-native login flow (SIWE) for web or mobile apps
• Verifying Ethereum address ownership on a backend service
• Protecting auth flows from replay attacks and enforcing nonce consumption
• Supporting EOAs and smart contract wallets (ERC-1271) in signature verification
• Parsing and validating EIP-4361 message fields like domain, chainId, and expiration

Best practices

• Always generate and store a unique nonce per login attempt with a TTL on the backend
• Consume and delete the nonce when a signature is verified to prevent replay
• Verify the message domain matches the expected host to avoid phishing
• Check chainId, expirationTime, and notBefore fields strictly during verification
• Use a PublicClient to validate ERC‑1271 smart contract signatures rather than EOA-only helpers

Example use cases

• Web app login: generate nonce, send SIWE message to wallet, verify signature server-side, start session
• API endpoint that accepts SIWE proofs to grant temporary API keys tied to an Ethereum address
• Onboarding flow that links a user account to an on‑chain identity using EIP‑4361 messages
• Mobile dApp that verifies user address ownership and enforces network and domain constraints