Authentication

The wallet proves control of its key by signing a server-issued challenge, then exchanges the signature for an access / refresh token pair:

1. Call Get sign-in challenge with the user's public key. The response contains the data to sign (messageToSign).
2. Sign that data with the corresponding private key.
3. Submit the signature to Get access tokens to receive an accessToken and a refreshToken.
4. Send every authenticated request with Authorization: Bearer <accessToken>.
5. When the access token expires, get a fresh pair via Refresh access tokens.