Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
verifyRequest – ERC-8128
Skip to content

verifyRequest

Verify an ERC-8128 signed HTTP request.

Usage

Pass an argument object with request, verifyMessage, nonceStore, and optional policy/setHeaders. The function returns a VerifyResult indicating success or failure.

import { verifyRequest } from '@slicekit/erc8128'
 
// Simple: request + required dependencies + policy
const result = await verifyRequest({
  request,
  verifyMessage,
  nonceStore,
  policy: {
  maxValiditySec: 300,
  },
})
 
if (result.ok) {
  console.log(`Authenticated: ${result.principal.address} on chain ${result.principal.chainId}`)
} else {
  console.log(`Failed: ${result.reason}`)
}

Returns

VerifyResult

An object indicating success or failure:

if (result.ok) {
  // Success — access verified data
  result.principal // Delegation root or base-profile authenticated account
  result.signer    // Account that signed this request
  result.delegated // Whether a delegation authenticated the principal
  result.label     // Signature label
  result.components // Signed components
  result.replay      // "non-replayable" or "replayable"
  if (result.delegated) {
    result.delegationIds // Ordered 32-byte revocation identifiers
  }
  result.binding   // "request-bound" or "class-bound"
} else {
  // Failure — check reason
  result.reason    // VerifyFailReason
  result.detail    // Optional detail message
}

Parameters

verifyRequest({
  request: Request,
  verifyMessage: VerifyMessageFn,
  nonceStore: NonceStore,
  policy?: VerifyPolicy,
  setHeaders?: (name: string, value: string) => void
): Promise<VerifyResult>

request

  • Type: Request

The Request to verify.

verifyMessage

Signature verification function. Use createUniversalAccountVerifier with a viem public client to preserve ERC-6492/ERC-1271 ordering and strict EOA encoding.

nonceStore

Replay protection store for non-replayable requests.

policy (optional)

Verification policy with rules for validation. Signatures are verified in the order they appear in Signature-Input after filtering to ERC-8128 tags and CAIP-10 key identifiers. Use maxSignatureVerifications to cap how many request candidates are tried (default: 8). Universal Account classification and proof callbacks share maxAccountVerificationCalls across all candidates; it defaults to 2 + maxChainDepth (6 at the default chain depth). Exhaustion fails with the applicable verification-unavailable reason. If replayable: true, you must provide either replayableNotBefore or replayableInvalidated.

setHeaders (optional)

  • Type: (name: string, value: string) => void

Callback to set response headers. When provided, verifyRequest sets Accept-Signature with one canonical signature shape per supported policy: the nonce-bearing request-bound baseline, plus one representative shape for each class-bound policy.

Examples

These examples show strict, relaxed, and custom-component verification policies.

Strict Policy
const result = await verifyRequest({
  request,
  verifyMessage,
  nonceStore,
  policy: {
  replayable: false,
  maxValiditySec: 60,
  maxNonceWindowSec: 60,
  clockSkewSec: 5,
  },
})