# FIP-11: Sign in With Farcaster

Open Dustin4444 opened this issue 1 month ago • 0 comments

FIP-11: Sign in With Farcaster

Title: Sign in With Farcaster Type: Standards FIP Authors: @v, @sanjay, @deodad, @horsefacts

Abstract

A standard that allows Farcaster users to authenticate into other applications using the EIP-4361 “Sign in With Ethereum” standard. Conceptually similar to “Sign in with Google”.

Problem

A user should be able to sign in to a third-party app using a signature from their Farcaster account. In theory, this is possible since a Farcaster account is an Ethereum wallet and there are standards for producing and transmitting signatures.

In practice there are two problems:

Most users are on Warpcast which doesn’t have a signature request flow.
The most common request flows (e.g. WalletConnect) are not 100% reliable on mobile.

Specification

The proposal includes two standards:

A Sign in with Farcaster signature format, for producing valid signatures.
A Sign in with Farcaster request flow, for requesting signatures from Warpcast.

Signature Format

A user must produce an EIP-4361 Sign in With Ethereum message signed by the custody address. The message must include the following fields defined in EIP-4361:

REQUIRED: The statement ”Farcaster Auth”
REQUIRED: A chain-id equal to 10 (The ID of Optimism Mainnet)
REQUIRED: A reference to the signing party’s FID as a resource, with the format farcaster://fids/<fid>.

The following message is an example:

https://example.com wants you to sign in with your Ethereum account:
0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2

Farcaster Auth

URI: https://example.com/login
Version: 1
Chain ID: 10
Nonce: djyP0B2JUD8RFuI3J
Issued At: 2021-09-30T16:25:24Z
Expiration Time: 2021-09-30T16:35:24Z
Resources:
- farcaster://fids/1234

Request Flow

An app can request a signature from the Warpcast client with a deeplink and uses a trusted FC Auth Relay server to proxy the results of the request back to the app.

A user clicks a “Sign in with Farcaster” button on an app.
The app makes an API call to the FC Auth Relay to create a new channel with a secret.
The app displays a QR code which will open Warpcast and pass along the channel secret.
The user scans the QR code with the mobile device and approves the request in Warpcast.
Warpcast produces the signature and uploads it to the channel on the FC Auth Relay.
The app, which has been polling for the signature from the channel, now receives it.

Auth Relay

The Auth Relay server acts as a relay between the app the user is signing in to (requesting app) and the Farcaster wallet app producing the signature (signing app). In the current implementation, the signing app is always the Warpcast mobile app, though this can be extended easily.

The server has three API endpoints:

Create Channel — used by requesting app to create a new channel
Authenticate — used by the signing app to post the signature to the channel
Status — used by the requesting app to fetch the signature from the channel

Connect

An app may call channel to request a new secret channel token, which is encoded both as a URL and as QR code that is displayable to the user. A channel lives for one hour on the connect server after which it is expired.

POST [https://connect.farcaster.xyz/v1/c](https://connect.farcaster.xyz/connect)hannel


- `siweUri` REQUIRED. SIWE message URI. 
- `domain` REQUIRED. Origin domain of app frontend.
- `nonce` OPTIONAL. Nonce to use in generated SIWE message, at least 8 alphanumeric
          characters. If a nonce is not provided, one will be generated by the 
          connect server and returned in the response.
- `notBefore` OPTIONAL. The time when the signed authentication message
              will become valid. Its value must be an ISO 8601 datetime string.
- `expirationTime` OPTIONAL. The time when the signed authentication message 
              is no longer valid. Its value must be an ISO 8601 datetime string.
- `requestId` OPTIONAL. A system-specific identifier that may be used to uniquely
               refer to the sign-in request.
- `redirectUrl` OPTIONAL. A url to redirect the user after a signature has been provided.


- Responses 


	201 CREATED	
	- `channelToken`: Connect relay channel token UUID.
	    - "3b842370-c519-4cd1-a30f-fdaece6a566"

	- `url`: Sign in With Farcaster URL to present to the user.
	    - "https://warpcast.com/~/sign-in-with-farcaster?nonce=djyP0B2JUD8RFuI3J&channelToken=3b842370-c519-4cd1-a  
	30f-fdaece6a566&domain=example.com&uri=https://example.com/login&redirectUrl=https://example.com/login"
	
	400 BAD REQUEST - Missing or invalid request params

Authenticate

A signing app (Warpcast) can call authenticate to post an SWIF signature message along with metadata about the user back to the channel to fulfill the request. The connect server does not accept signatures from non-warpcast clients, though this can be changed in the future.

POST https://connect.farcaster.xyz/v1/channel/authenticate

- Headers:
  - `Authorization: Bearer <channelToken>`
  - `X-Farcaster-Auth-Relay-Key: <authKey>`
  - `channelToken`: UUID channel identifier
  - `authKey`: API auth key

- Body JSON:
  - `{"message": "example.com wants you to sign in...", "signature": "0x113a68..77460f"}`
  - `message`: SIWE message string
  - `signature`: Hex signature
  - `fid`: User's fid 
  - `username`: Username (string)
  - `bio`: Bio for the user (string)
  - `displayName`: Display Name for the user (string)
  - `pfpUrl`: Profile picture URL


- Responses
	200 OK - Message accepted
	401 UNAUTHORIZED - Channel token does not exist or expired
	400 BAD REQUEST - Missing/invalid request params

Status

A requesting app with the channel secret can poll status to check the status of the request and fetch the SWIF signature message and metadata if submitted by the signing app.

GET https://connect.farcaster.xyz/channel/status

- Required headers:
    - `Authorization: Bearer <channelToken>`
    - `channelToken`: UUID channel identifier


- Body JSON
    - `state`'pending' | 'completed'
    - `nonce` SIWE message nonce
    - `message`. SIWE message.
    - `signature` SIWE message signature.
    - `fid` user FID
    - `username` preferred Farcaster name for the user
    - `bio` user bio
    - `displayName` user profile display name
    - `pfpUrl` user profile photo

- Responses
	200 OK - Auth pending or completed
	401 UNAUTHORIZED - Channel token does not exist or expired

Warpcast

Warpcast implements a Sign in with Farcaster approval screen which is triggered by the deeplink. When approved, it generates the signature and uploads it to the channel.

Rationale

Why not support non-Warpcast clients?

Warpcast is the only actively developed wallet client today. This design can easily be extended to support non-Warpcast clients, but doing it today carries no additional benefit and might be less robust since we’re not getting feedback from these clients about their constraints.

Why not use Wallet Connect to transport signatures?

Wallet Connect still fails occasionally on mobile devices for reasons that are not easy to divine. We made an explicit tradeoff to optimize for the user experience and use a hosted, trusted server. Wallet Connect can be adopted in the future if it becomes easier to use on mobile.

Why can’t we sign with a delegate signer?

It adds a lot of complexity for little benefit. Signatures would require a two step verification with hubs.

Why not allow sign in with verified wallet?

This adds significantly more complexity: display and select FC wallet vs non FC wallet, connecting the correct verified wallet, a rainbowkit type modal, connect to metamask/WalletConnect, then produce signature. The benefit is that it is nicer for the desktop to desktop case, but that does not seem worth the additional UI overhead. This is a nice to have worth considering in the future.

Release

Sign in with Farcaster does not require any changes to hubs or contracts. It is ready to use as of 01/12 when the Auth Relay server and Warpcast changes went live.

Originally posted by @varunsrin in https://github.com/farcasterxyz/protocol/discussions/110

Nov 12 '25 02:11 Dustin4444