Skip to main content
POST
Create wallet session

Headers

Idempotency-Key
string<uuid>
required

Lowercase UUIDv7 naming this command, unique per caller and route. A retry with the same key and body returns the original result; the same key with a different body returns 409 IDEMPOTENCY_KEY_REUSED.

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

Body

application/json

Proves the challenge with the wallet's personal_sign signature over the exact message.

challenge_id
string<uuid>
required

The challenge_id from POST /v1/auth/wallet-challenges; each proves one session.

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
signature
string
required

The wallet's personal_sign signature over the challenge's exact message.

Pattern: ^0x[0-9a-f]{130}$

Response

Wallet session

A bearer session for the wallet's account. It lasts at most 30 days and ends after 7 days without an API request, or at logout. It authenticates the account; every bet, cash-out and withdrawal still needs the wallet's own signature.

token_type
any
required

Always Bearer: send the token as Authorization: Bearer <access_token>.

access_token
string
required

The session token. It works only with the Origin it signed in from; keep it out of URLs and logs.

Required string length: 1 - 4096
account_id
string<uuid>
required

Totalis account ID.

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
address
string
required

The signed-in wallet, which is the account's wallet.

Pattern: ^0x[0-9a-f]{40}$
issued_at
string<date-time>
required

When the session was issued, RFC 3339 UTC.

Maximum string length: 30
Pattern: ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$
expires_at
string<date-time>
required

The 30-day cap; the 7-day idle limit can end the session sooner.

Maximum string length: 30
Pattern: ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$