User Ownership: Non-Custodial Wallets and Asset Control

Your application requests a transaction
  ↓
SocketFi prepares an authorization message
  ↓
User's device signs it with their passkey (Face ID, Touch ID, etc.)
  ↓
Signature is verified by the wallet contract on Soroban
  ↓
Transaction executes — or is rejected

// After authentication, verify the session token on your backend
// to obtain the wallet address — never trust client-provided values.
const session = await socketfi.authenticate();
const token = session.socketfiAccessToken;

// Send the token to your backend; verify it server-side with verifyAuth()
// and read the wallet address from the verified payload (see below).

// Backend: verify the session token and extract the wallet address
import { verifyAuth } from "@socketfi/server";

async function protectedRoute(req, res) {
  const token = req.headers.authorization?.replace("Bearer ", "");

  // verifyAuth returns { valid: boolean, user: { id }, wallet: { address } }
  const verified = await verifyAuth(token);

  if (!verified.valid) {
    return res.status(401).json({ error: "Unauthorized" });
  }

  // verified.wallet.address is cryptographically bound to this session
  // Use this value — not req.body.walletAddress
  const user = await db.users.findByWalletAddress(verified.wallet.address);
  return res.json({ user });
}