Noemad Docs
Your wallet is your identity
Wallet connection, sign-in, and spending authorization are separate permissions.
Connect an installed wallet
The UI uses EIP-6963 discovery with an EIP-1193 injected-provider fallback. Address access is requested only after you choose a wallet. Private keys and recovery phrases are never requested.
Mobile wallets must expose an injected provider in their in-app browser. WalletConnect QR pairing is not connected in this preview.
Verify ownership
The server validates the SIWE challenge, domain, URI, chain, nonce, time and origin. Nonces are single-use. Sessions use Secure, HttpOnly, SameSite cookies and CSRF protection. Reload recovers the same session-bound CSRF token; sign-out revokes the session. Contract-wallet support must be qualified before it is advertised.
POST /_monad/v1/auth/challenge
POST /_monad/v1/auth/verifyWallet-owned API keys
Product keys belong to the wallet account and scope access to its own requests, files, jobs and usage. They are not provider credentials and do not automatically authorize wallet spending.
Authorize a bounded request
The x402 v2 upto flow uses the pinned SDK’s Permit2/proxy mechanism. Allowance and request authorization are reviewed separately when needed. The signed maximum limits collection; it does not reserve wallet funds.
Account changes
Disconnect or account changes clear the live wallet data and revoke the previous session. Each inference needs an explicit payment authorization. Manage wallet site permissions and remaining token allowance inside your wallet.