Protocol / Identity / Sign-In with Ethereum
shippedLayer 1 · Protocol

Sign-In with Ethereum

The SIWE message an owner wallet signs to root authority — carrying a ReCap of capabilities and serialized as a CACAO that becomes the root delegation.

Sign-In with Ethereum

SIWE (Sign-In with Ethereum, EIP-4361) is the single human-facing signature that roots a TinyCloud session. The owner's wallet signs a SIWE message whose statement embeds a ReCap — the capabilities being granted — and the signed result is serialized as a CACAO that becomes the root delegation of the session.

Role

SIWE is where the owner DID (did:pkh:eip155:…) exercises root authority in Layer 1. One wallet signature simultaneously proves control of the address and authorizes a scoped capability set to an ephemeral session key — so the wallet need not sign again for ordinary operations.

Mechanics

  1. The client assembles the capabilities the app/manifest needs and encodes them as a ReCap (urn:recap:…) appended to the SIWE message (dependencies/siwe-recap/src/capability.rs).
  2. The wallet signs the SIWE string; the signature + message are wrapped into a CACAO (dependencies/cacao).
  3. The node accepts that CACAO as a TinyCloudDelegation root (tinycloud-auth/src/authorization.rs), the source of the delegation chain every later invocation traces to.

The client builds and signs this in packages/sdk-core/src/userAuthorization.ts (prepareSession → wallet signs → completeSessionSetup); see sign-in-flow for the full sequence and cacao-chain-validation for how the node validates it.

Relationships

Signed by the owner DID; encodes capabilities as a ReCap; serialized as a CACAO; produces the root delegation that a session key extends; the full client flow is sign-in-flow; node-side validation is cacao-chain-validation.

Example

A wallet signs one SIWE message granting tinycloud.space/host + tinycloud.kv/* over …:default; the resulting CACAO roots the session, and the session key thereafter signs invocations with no further wallet prompts.

Status & drift

Shipped. SIWE+ReCap is the root-authority path; sub-delegations and invocations use UCAN.

Sources

  • tinycloud-node: tinycloud-auth/src/authorization.rs, dependencies/siwe-recap/src/capability.rs
  • js-sdk: packages/sdk-core/src/userAuthorization.ts