> ## Documentation Index > Fetch the complete documentation index at: https://docs.renaiss.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Get a sign-in message > Request a one-time message for the wallet to sign before it can access private redemption and shipping details. The message expires in five minutes. 1. From your backend, send the registered frontend `origin` and both scopes, `redeem:read` and `redeem:write`. 2. Check the builder app ID, issuer, audience and scopes in `context` against your app’s settings before prompting the user. 3. Have the wallet sign `message` exactly as returned with `personal_sign`. Use the challenge once within five minutes. Send the message and signature to [verify the wallet](https://docs.renaiss.xyz/api-reference/auth/verify-message.md). Keep `context` on your side. ## Request Builder key required ## Response ## Error codes Match the HTTP status and response text to a row below. For guidance on codes shared across endpoints, see [Error meanings and recovery](https://docs.renaiss.xyz/api-reference/errors.md). | HTTP | Error code | Text field | Response text and recovery | | :- | :- | :- | :- | | `400` | `API_AUTH_INVALID_INPUT` | `error` | `Invalid authentication input` `Request body is too large` A field is missing or has the wrong form, the body is larger than 12 KiB, or the origin, chain or scope is not registered for your builder. Fix the request and send it again. | | `400` | No code | `text/plain` | `Malformed JSON in request body` | | `401` | `API_AUTH_INVALID_CREDENTIAL` | `error` | `Invalid authentication credential` The builder key is malformed, unknown, expired or revoked. Check the key. Do not retry with the same key. | | `401` | `API_AUTH_MISSING_CREDENTIAL` | `error` | `Required authentication credential is missing` No builder key was sent. Send your builder key in the `x-builder-api-key` header. | | `403` | `API_AUTH_CREDENTIAL_NOT_ALLOWED` | `error` | `Credential is not allowed by this policy` This route takes a builder key only. Remove the `Authorization` header and any other credential, then send the request again. | | `403` | `GACHA_V3_BUILDER_NOT_ACCEPTED_ON_PUBLIC_API` | `error` | `This builder checks out on its own surface, not on the public API` This builder key cannot be used on this API. Do not retry; contact Renaiss. | | `429` | `API_AUTH_RATE_LIMITED` | `error` | `Authentication rate limit exceeded` The builder key hit its rate limit. Wait a little, then retry at a lower rate. | | `500` | `API_AUTH_INVALID_CONFIGURATION` | `error` | `Internal server error` Contact Renaiss with `x-request-id` if wallet authentication keeps failing. | | `500` | `API_AUTH_ERROR` | `error` | `Internal server error` | | `500` | `FUNCTION_ERROR` | `error` | `Internal server error` | | `500` | No code | `text/plain` | `Internal Server Error` | ## OpenAPI ````yaml api-reference/openapi.json POST /v2/auth/wallet/nonce openapi: 3.1.1 info: version: 1.0.0 title: Renaiss Builder API v2 description: >- Builder API v2 for gacha, marketplace and redemption with external wallets on BNB Smart Chain (chain 56). Any active, approved builder key can prepare purchases. A collectible is an item a wallet can pull, trade, sell back or redeem, such as a card. This API calls every such item a collectible (e.g. cards), in paths, fields and descriptions. Browse publicly, then prepare and sign actions with the buyer wallet. Gacha history and buyback offers require your builder key; purchases and buybacks also require a wallet action signature. Private shipping data and redemption require a wallet access token, which the API issues from a registered partner origin after the wallet signs a sign-in message. Gacha and marketplace never use a wallet access token. Keep the builder key on your backend. The acting wallet is an EOA or a deployed ERC-1271 contract account. EIP-7702 delegated accounts, ERC-6492 and ERC-8010 wrapped signatures and Renaiss-managed Safes are refused (a Safe only after its signature verified). A pull to a contract account that cannot receive ERC-721 tokens returns `CONTRACT_WALLET_CANNOT_RECEIVE_NFT`. A failed chain read returns `API_AUTH_ERROR` (500). Wallet access tokens and redemption are EOA only. servers: - url: https://api.renaiss.xyz description: BNB Smart Chain - url: https://dev-api.renaiss.xyz description: BNB testnet security: [] tags: - name: Gacha v2 description: >- Direct-EOA pack browsing, purchases, collectible (e.g. card) reveals, purchase history and buybacks. Start here; no wallet access token is needed. - name: Marketplace description: >- Public collectible (e.g. card) browsing and external-wallet asks, bids, purchases and cancellations. Trading requires builder authorization and wallet action signatures. - name: Users description: >- What one wallet address has and did: its collectibles (e.g. cards), their total market value and its activities. The whole wallet, whichever builder it used. Requires your builder key only. - name: Redemption description: >- Shipping eligibility, quotes, redemption preparation, submission and tracking. Requires your builder key and a wallet access token for the same wallet. - name: Wallet access tokens description: >- Get, refresh and revoke the wallet access tokens that Redeem needs. The wallet signs a sign-in message (valid 5 minutes, one use); the API returns a wallet access token (15 minutes) and a refresh token (7 days, single use). Register exact partner frontend origins with Renaiss before use. Gacha and marketplace never use a wallet access token. paths: /v2/auth/wallet/nonce: post: tags: - Wallet access tokens summary: Get the sign-in message for a wallet description: >- Request a one-time message for the wallet to sign before it can access private redemption and shipping details. The message expires in five minutes. requestBody: required: true content: application/json: schema: type: object properties: origin: type: string maxLength: 2048 format: uri description: >- Exact registered partner frontend origin (scheme, host and port), without a trailing slash or path. example: http://localhost:3100 walletAddress: type: string chainId: type: integer exclusiveMinimum: 0 scopes: type: array items: type: string enum: - redeem:read - redeem:write description: >- Must name exactly `redeem:read` and `redeem:write`, once each, in either order. Any other list is refused with 400 `API_AUTH_INVALID_INPUT`. required: - origin - walletAddress - chainId - scopes additionalProperties: false responses: '200': description: Success content: application/json: schema: type: object properties: challengeId: type: string format: uuid message: type: string expiresAt: type: string format: date-time context: type: object properties: builderAppId: type: string format: uuid issuer: type: string format: uri audience: type: string format: uri scopes: type: array items: type: string required: - builderAppId - issuer - audience - scopes description: >- Use it to check the sign-in message; do not send it back to verify. required: - challengeId - message - expiresAt - context '400': description: >- The request was refused before anything happened. A body that is not valid JSON is refused with a plain-text 400. See [error codes and recovery](/api-reference/auth/get-sign-in-message#http-errors). content: text/plain: schema: type: string example: Malformed JSON in request body application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_INVALID_INPUT required: - error - code example: error: Invalid authentication input code: API_AUTH_INVALID_INPUT '401': description: >- The builder key is missing or not accepted. See [error codes and recovery](/api-reference/auth/get-sign-in-message#http-errors). content: application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_MISSING_CREDENTIAL - API_AUTH_INVALID_CREDENTIAL required: - error - code example: error: Required authentication credential is missing code: API_AUTH_MISSING_CREDENTIAL '403': description: >- The builder key is not allowed to make this request. See [error codes and recovery](/api-reference/auth/get-sign-in-message#http-errors). content: application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_CREDENTIAL_NOT_ALLOWED - GACHA_V3_BUILDER_NOT_ACCEPTED_ON_PUBLIC_API required: - error - code example: error: Credential is not allowed by this policy code: API_AUTH_CREDENTIAL_NOT_ALLOWED '429': description: >- Too many requests with this builder key. See [error codes and recovery](/api-reference/auth/get-sign-in-message#http-errors). content: application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_RATE_LIMITED required: - error - code example: error: Authentication rate limit exceeded code: API_AUTH_RATE_LIMITED '500': description: >- A failure on our side. Retry later. See [error codes and recovery](/api-reference/auth/get-sign-in-message#http-errors). content: text/plain: schema: type: string example: Internal Server Error application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string required: - error - code example: error: Internal server error code: FUNCTION_ERROR security: - builderAuth: [] components: securitySchemes: builderAuth: type: apiKey in: header name: x-builder-api-key description: >- Your approved builder API key. Keep it on your backend. Gacha and marketplace writes also require wallet action signatures. Redeem also needs a wallet access token, a Bearer token the API issues after the wallet signs a sign-in message. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.