> ## Documentation Index
> Fetch the complete documentation index at: https://79cdaa32-9b19-4e9d-ab9d-a89800ef0f46.valox.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication Flow

> Use Sign-In with Ethereum (SIWE) to authenticate API requests.

Our authentication system uses Sign-In with Ethereum (SIWE) to generate a `jwt` to interact with our API.
This means you don't need to handle the storage of a powerful API key or spend hours configuring granular permissions.

## Authentication Process

<Steps titleSize="h3">
  <Step title="Generate a Nonce to sign a SIWE Message">
    Before initiating authentication, [the application must request a nonce](/api-reference/authentication/generate-nonce).
    Your application then presents this nonce to the user for signing as part of the SIWE flow.

    ```bash cURL theme={null}
    curl -X GET /api/v1/auth/nonce
    ```
  </Step>

  <Step title="Sign the SIWE Message with your Wallet or Provider">
    Our API accepts signatures from Externally Owned Accounts (EOAs) and Smart Accounts (EIP-1271).

    <Warning>
      The signer must be an owner of a Valox account.
      Non-registered users will receive `401 Unauthorized` on most authenticated routes
    </Warning>
  </Step>

  <Step title="Verify the Signature and get an Access Token">
    <Note>
      **JWT length validity**

      * **Default Validity**: JWT tokens are valid for the duration specified in `ttlInSeconds` during SIWE authentication
      * **Minimum Duration**: 1 hour
      * **Maximum Duration**: 24 hours
    </Note>

    After the message is signed, you need to submit both the message and the signature to [retrieve an Access Token](/api-reference/authentication/verify-siwe-signature):

    ```bash cURL theme={null}
    curl -X POST /api/v1/auth/challenge \
      -H "Content-Type: application/json" \
      -d '{
        "message": "string",
        "signature": "string",
        "ttlInSeconds": 36000
      }'
    ```
  </Step>
</Steps>

<Warning>
  The SIWE message contains a `domain` and a `uri` field. You should ensure their values are **not** `127.0.0.1` or `localhost`, even when working locally. Override these fields (e.g., with `domain: "somedomain.com", uri: "https://www.somedomain.com"`) to prevent firewall blocks and "WAFForbidden" errors.
</Warning>

Upon successful verification, a `jwt` is generated.
This `jwt` must be included in the Authorization header of all subsequent HTTP requests to authenticate with the Valox API:

```bash theme={null}
Authorization: Bearer {jwt}
```

## Details about the Access Token

A `jwt` is generated upon successful Sign-In with Ethereum (SIWE) verification and can remain valid for up to **24 hours**, depending on the **`ttlInSeconds`** parameter passed to SIWE, with a minimum validity period of 1 hour.

To enhance security and prevent replay attacks, each authentication attempt requires a new and unique nonce.

Always ensure that the `jwt` is valid before making API requests.
If an API request returns a 401 Unauthorized response due to an expired token,
your application must restart the authentication process, which requires user interaction.
This means the application must request a new nonce, prompt the user to sign the message,
and then submit the signature for verification to generate a fresh `jwt`.