Skip to content

4.0Access & security

Wallet sign-in

Signing in proves you control an address. It is a message, never a transaction.

The message

text
kibora.xyz wants you to sign in with your Ethereum account:
0x…your address…

Kibora terminal login. Signing this only proves you hold the address above; nothing is sent and no fee is paid.

URI: https://kibora.xyz/terminal
Version: 1
Chain ID: 4663
Nonce: <24 hex characters, single use>
Issued At: <time>
Expiration Time: <time + 24 hours>

What the server checks

  • The message is rebuilt on the server from its own parts. The domain is always the real one, never taken from the request.
  • The signature must match the address; only then is the nonce spent, so nobody can burn your nonce.
  • The nonce must have been issued in the last 10 minutes and never used.

What the server keeps

With storage configured: your address next to your beta code (about three years), and nonces for ten minutes. Nothing else. Without storage the code service shows as not configured.