This endpoint completes the authentication process by verifying that the provided signature was created with the private key corresponding to the public key. Upon successful verification, a JWT access token is issued for making authenticated API calls.

Authentication Process

1. The signature is verified against the challenge issued in the previous step
2. If valid, the user’s account is created (if new) or retrieved
3. A JWT access token is generated and returned
4. The challenge is invalidated to prevent replay attacks

Token Usage

The returned JWT token should be included in subsequent API calls:

Authorization: Bearer <access_token>

Security Considerations

• Each challenge can only be used once
• The signature must be a valid secp256k1 signature
• The public key must match the one used to request the challenge

Arguments

• public_key - The public key that was used to request the challenge
• signature - The hex-encoded secp256k1 signature of the challenge

Returns

• 200 OK with the JWT access token
• 400 Bad Request if the request is malformed or authentication flow is incorrect
• 403 Forbidden if the signature is invalid
• 404 Not Found if no challenge exists for the public key
• 500 Internal Server Error if token generation fails