HooderAiWallet login, done right
Aug 21, 2026 · HooderAi journal
No passwords to leak, no emails to phish: HooderAi identity is a wallet address proven by one signature. This piece documents the nonce flow, session design, and the exact guarantees — plus what we deliberately do not do.
The three-step handshake
Step one: POST /api/auth/nonce with your address. The server creates you if needed and returns a random 16-byte nonce plus the exact message to sign: HooderAi login, your address, the nonce. Nonces expire in ten minutes and are single-use.
Step two: personal_sign the message in MetaMask or Rabby. Step three: POST /api/auth/verify with address, nonce, signature. The server checks viem verifyMessage, deletes the nonce so it can never replay, and mints a session token hs- with a 7-day expiry — hashed with SHA-256 at rest, plus an httpOnly cookie for browsers.
What the session can and cannot do
Sessions manage keys, view usage and balance, request withdrawals, and refresh holder tiers. They cannot move money — payouts still need a human admin. They cannot mint keys for other wallets — every key row is bound to the session's user id, and revoke checks ownership.
Machine calls use hk- keys, not sessions. The two credentials never mix: a stolen API key cannot open the console, and a stolen session cookie cannot call models — it can only manage keys, and it expires in seven days.
What we do not do
No passwords, so no password database to breach. No emails, so no reset-flow phishing surface. Nonces are deleted on use, so replays fail closed. Raw API keys appear exactly once at creation — only the SHA-256 hash is stored, so a database read yields nothing callable.
Logout deletes the session row server-side and clears the cookie plus localStorage token. There is no refresh-token chain to unwind — one row, one delete, done.
Guide · 8 min read