Authentication and consent

vibe.market is an experimental protocol. Review the Terms. Never ask users to sign a different message while describing it as harmless sign-in.

Public reads are keyless

The current market’s public runtime, catalog, release, room and follow-list reads do not require an API-KEY. The API-key instructions in Classic apply to Classic, not to this API.

Account session

The website requests an explicit wallet signature and posts the envelope to /api/vibemarket2/account/session:

{
  "address": "0x1111111111111111111111111111111111111111",
  "origin": "https://vibechain.com",
  "nonce": "d59077c8-d239-4fc6-ae67-0dcefeeb9068",
  "expires": 1789050000000,
  "signature": "0x..."
}

The values above illustrate the format, not a reusable request. Generate a fresh UUID v4 nonce and a future Unix-millisecond expiry no more than five minutes away. Sign with the stated wallet; the request Origin must match the signed origin. Sign this exact message (substitute values; lowercase the wallet, preserve line breaks, and add no trailing newline):

Vibe Market 2 — sign in
Website: {origin}
Wallet: {lowercaseAddress}
Nonce: {nonce}
Expires: {expires}

Remember this browser for 30 days. Authorize chat, follows, referrals, drafts, wishlists, pack artwork edits, and your shared Vibechain profile and X connection.
This session cannot spend tokens, approve allowances, transfer assets, or make blockchain transactions. Disconnect to sign out.

The production allowlist is https://vibechain.com, https://www.vibechain.com, https://vibe.market and https://www.vibe.market. An arbitrary third-party origin, including this documentation site, is not supported. Do not bypass this restriction or forward a first-party session to another website.

Backend versus website proxy

	Direct backend	First-party website proxy
Sign-in response	`{address, token, expiresAt}`	`{address, expiresAt}`; token is not exposed to JavaScript
Session transport	`Authorization: Bearer {token}`	HttpOnly `vm2-session` cookie
Binding	`Origin` and `X-VM2-Wallet` matching the consent	Proxy validates origin and carries session to backend
Cookie policy	Not applicable	Secure in production, SameSite Strict, path `/api/vibemarket2`
Lifetime	Up to 30 days; revocable	Same session lifetime

Store backend tokens as credentials. Do not put them in URLs, logs or public code. Reauthorize after wallet switches; an existing session cannot act as another wallet. Use GET /account/session to check the session and DELETE /account/session to sign out. The account session authorizes only the allowlisted offchain actions on POST /account: releases, artwork edits, chat, DMs, follows, access/referrals, profile/X connection and safety settings/reports.

Private messages

Backend /dm/threads, /dm/messages and /dm/unread use the same account bearer token, origin and wallet binding. Send messages with POST /account and kind: "dm"; mark a conversation read with kind: "dm-seen". An account session does not confer onchain spending authority.

Standalone signed writes

POST /releases and POST /runtime/{version}/pack-edit accept per-action signatures instead of an account session. Each has its own exact message and replay protection. Do not sign arbitrary JSON or reuse the account sign-in message. The shared parsers normalize fields and determine the signed JSON order. Use the matching release/pack-edit message helper from the integration source described in contract interfaces; reimplementing serialization without the same parser can invalidate signatures. For releases, the message is:

Vibe Market 2 — offchain release catalog
Wallet: {lowercaseAddress}
Nonce: {nonce}
Expires: {expires}
Action: {JSON.stringify(parseAction(action))}
This signature cannot launch a pool or spend tokens.

Narrower session endpoints

Existing /chat/session sessions authorize the room and the compatible follow-write routes, not account actions or DMs. Invite-only /access sessions use X-VM2-Session, not the account bearer token. New first-party clients should use account actions rather than treating these narrower sessions as interchangeable.

Deleting a hosted account

POST /account/delete requires an account session and a fresh, separate deletion signature, using the exact deletionMessage helper. A sign-in signature does not authorize deletion. Deletion removes hosted account data and signs out devices; it cannot erase public blockchain history, remove a wallet or move funds. Published asset metadata remains. Abuse reports expire after 90 days; moderation and account-deletion audit records are retained indefinitely, with minimal revocation/moderation records kept to prevent abuse and reuse of deleted sessions. Do not call this endpoint as a connectivity test.

vibe.market

vibe.market Classic

Company

Public reads are keyless

Account session

Backend versus website proxy

Private messages

Standalone signed writes

Narrower session endpoints

Deleting a hosted account

​Public reads are keyless

​Account session

​Backend versus website proxy

​Private messages

​Standalone signed writes

​Narrower session endpoints

​Deleting a hosted account

Public reads are keyless

Account session

Backend versus website proxy

Private messages

Standalone signed writes

Narrower session endpoints

Deleting a hosted account