> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vibechain.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and consent

> Public reads, wallet signatures, origin-bound accounts and scoped sessions.

<Warning>
  vibe.market is an **experimental protocol**. Review the [Terms](https://vibechain.com/terms). Never ask users to sign a different message while describing it as harmless sign-in.
</Warning>

## Public reads are keyless

The current market's public runtime, catalog, release, room and follow-list reads do not require an `API-KEY`. The API-key instructions in [Classic](/api-reference/vibemarket-classic-intro) apply to Classic, not to this API.

## Account session

The website requests an explicit wallet signature and posts the envelope to `/api/vibemarket2/account/session`:

```json theme={null}
{
  "address": "0x1111111111111111111111111111111111111111",
  "origin": "https://vibechain.com",
  "nonce": "d59077c8-d239-4fc6-ae67-0dcefeeb9068",
  "expires": 1789050000000,
  "signature": "0x..."
}
```

The values above illustrate the format, not a reusable request. Generate a fresh UUID v4 nonce and a future Unix-millisecond expiry no more than five minutes away. Sign with the stated wallet; the request `Origin` must match the signed origin.

Sign this exact message (substitute values; lowercase the wallet, preserve line breaks, and add no trailing newline):

```text theme={null}
Vibe Market 2 — sign in
Website: {origin}
Wallet: {lowercaseAddress}
Nonce: {nonce}
Expires: {expires}

Remember this browser for 30 days. Authorize chat, follows, referrals, drafts, wishlists, pack artwork edits, and your shared Vibechain profile and X connection.
This session cannot spend tokens, approve allowances, transfer assets, or make blockchain transactions. Disconnect to sign out.
```

The production allowlist is `https://vibechain.com`, `https://www.vibechain.com`, `https://vibe.market` and `https://www.vibe.market`. An arbitrary third-party origin, including this documentation site, is not supported. Do not bypass this restriction or forward a first-party session to another website.

### Backend versus website proxy

|                   | Direct backend                                   | First-party website proxy                                      |
| ----------------- | ------------------------------------------------ | -------------------------------------------------------------- |
| Sign-in response  | `{address, token, expiresAt}`                    | `{address, expiresAt}`; token is not exposed to JavaScript     |
| Session transport | `Authorization: Bearer {token}`                  | HttpOnly `vm2-session` cookie                                  |
| Binding           | `Origin` and `X-VM2-Wallet` matching the consent | Proxy validates origin and carries session to backend          |
| Cookie policy     | Not applicable                                   | Secure in production, SameSite Strict, path `/api/vibemarket2` |
| Lifetime          | Up to 30 days; revocable                         | Same session lifetime                                          |

Store backend tokens as credentials. Do not put them in URLs, logs or public code. Reauthorize after wallet switches; an existing session cannot act as another wallet.

Use `GET /account/session` to check the session and `DELETE /account/session` to sign out. The account session authorizes only the allowlisted offchain actions on `POST /account`: releases, artwork edits, chat, DMs, follows, access/referrals, profile/X connection and safety settings/reports.

## Private messages

Backend `/dm/threads`, `/dm/messages` and `/dm/unread` use the same account bearer token, origin and wallet binding. Send messages with `POST /account` and `kind: "dm"`; mark a conversation read with `kind: "dm-seen"`. An account session does not confer onchain spending authority.

## Standalone signed writes

`POST /releases` and `POST /runtime/{version}/pack-edit` accept per-action signatures instead of an account session. Each has its own exact message and replay protection. Do not sign arbitrary JSON or reuse the account sign-in message.

The shared parsers normalize fields and determine the signed JSON order. Use the matching release/pack-edit message helper from the integration source described in [contract interfaces](/docs/vibemarket/developers/interfaces); reimplementing serialization without the same parser can invalidate signatures.

For releases, the message is:

```text theme={null}
Vibe Market 2 — offchain release catalog
Wallet: {lowercaseAddress}
Nonce: {nonce}
Expires: {expires}
Action: {JSON.stringify(parseAction(action))}
This signature cannot launch a pool or spend tokens.
```

## Narrower session endpoints

Existing `/chat/session` sessions authorize the room and the compatible follow-write routes, not account actions or DMs. Invite-only `/access` sessions use `X-VM2-Session`, not the account bearer token. New first-party clients should use account actions rather than treating these narrower sessions as interchangeable.

## Deleting a hosted account

`POST /account/delete` requires an account session **and a fresh, separate deletion signature**, using the exact `deletionMessage` helper. A sign-in signature does not authorize deletion.

Deletion removes hosted account data and signs out devices; it cannot erase public blockchain history, remove a wallet or move funds. Published asset metadata remains. Abuse reports expire after 90 days; moderation and account-deletion audit records are retained indefinitely, with minimal revocation/moderation records kept to prevent abuse and reuse of deleted sessions. Do not call this endpoint as a connectivity test.