> ## Documentation Index > Fetch the complete documentation index at: https://docs.renaiss.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Verify a wallet signature > Exchange the original sign-in message and the wallet’s `personal_sign` signature for an access token and a refresh token. Send the `challengeId`, the original message and the wallet signature. The access token lasts 15 minutes. Use the single-use refresh token to [renew the session](https://docs.renaiss.xyz/api-reference/auth/refresh-tokens.md) within seven days of sign-in. Keep both tokens out of logs. ## Request Builder key and wallet signature ## Response ## Error codes Match the HTTP status and response text to a row below. For guidance on codes shared across endpoints, see [Error meanings and recovery](https://docs.renaiss.xyz/api-reference/errors.md). | HTTP | Error code | Text field | Response text and recovery | | :- | :- | :- | :- | | `400` | `API_AUTH_INVALID_INPUT` | `error` | `Invalid authentication input` `Request body is too large` A field is missing or has the wrong form, or the body is larger than 12 KiB. Fix the request and send it again. | | `400` | No code | `text/plain` | `Malformed JSON in request body` | | `401` | `API_AUTH_INVALID_CREDENTIAL` | `error` | `Invalid authentication credential` The builder key is not valid, or the `challengeId` is unknown, expired, already used or from another builder, or the message or signature does not match the sign-in message. Get a new sign-in message from nonce and have the wallet sign it again. | | `401` | `API_AUTH_MISSING_CREDENTIAL` | `error` | `Required authentication credential is missing` No builder key was sent. Send your builder key in the `x-builder-api-key` header. | | `403` | `API_AUTH_CREDENTIAL_NOT_ALLOWED` | `error` | `Credential is not allowed by this policy` This route takes a builder key only. Remove the `Authorization` header and any other credential, then send the request again. | | `403` | `GACHA_V3_BUILDER_NOT_ACCEPTED_ON_PUBLIC_API` | `error` | `This builder checks out on its own surface, not on the public API` This builder key cannot be used on this API. Do not retry; contact Renaiss. | | `429` | `API_AUTH_RATE_LIMITED` | `error` | `Authentication rate limit exceeded` The builder key hit its rate limit. Wait a little, then retry at a lower rate. | | `500` | `API_AUTH_INVALID_CONFIGURATION` | `error` | `Internal server error` Contact Renaiss with `x-request-id` if wallet authentication keeps failing. | | `500` | `API_AUTH_ERROR` | `error` | `Internal server error` | | `500` | `FUNCTION_ERROR` | `error` | `Internal server error` | | `500` | No code | `text/plain` | `Internal Server Error` | ## OpenAPI ````yaml api-reference/openapi.json POST /v2/auth/wallet/verify openapi: 3.1.1 info: version: 1.0.0 title: Renaiss Builder API v2 description: >- Builder API v2 for gacha, marketplace and redemption with external wallets on BNB Smart Chain (chain 56). Any active, approved builder key can prepare purchases. A collectible is an item a wallet can pull, trade, sell back or redeem, such as a card. This API calls every such item a collectible (e.g. cards), in paths, fields and descriptions. Browse publicly, then prepare and sign actions with the buyer wallet. Gacha history and buyback offers require your builder key; purchases and buybacks also require a wallet action signature. Private shipping data and redemption require a wallet access token, which the API issues from a registered partner origin after the wallet signs a sign-in message. Gacha and marketplace never use a wallet access token. Keep the builder key on your backend. The acting wallet is an EOA or a deployed ERC-1271 contract account. EIP-7702 delegated accounts, ERC-6492 and ERC-8010 wrapped signatures and Renaiss-managed Safes are refused (a Safe only after its signature verified). A pull to a contract account that cannot receive ERC-721 tokens returns `CONTRACT_WALLET_CANNOT_RECEIVE_NFT`. A failed chain read returns `API_AUTH_ERROR` (500). Wallet access tokens and redemption are EOA only. servers: - url: https://api.renaiss.xyz description: BNB Smart Chain - url: https://dev-api.renaiss.xyz description: BNB testnet security: [] tags: - name: Gacha v2 description: >- Direct-EOA pack browsing, purchases, collectible (e.g. card) reveals, purchase history and buybacks. Start here; no wallet access token is needed. - name: Marketplace description: >- Public collectible (e.g. card) browsing and external-wallet asks, bids, purchases and cancellations. Trading requires builder authorization and wallet action signatures. - name: Users description: >- What one wallet address has and did: its collectibles (e.g. cards), their total market value and its activities. The whole wallet, whichever builder it used. Requires your builder key only. - name: Redemption description: >- Shipping eligibility, quotes, redemption preparation, submission and tracking. Requires your builder key and a wallet access token for the same wallet. - name: Wallet access tokens description: >- Get, refresh and revoke the wallet access tokens that Redeem needs. The wallet signs a sign-in message (valid 5 minutes, one use); the API returns a wallet access token (15 minutes) and a refresh token (7 days, single use). Register exact partner frontend origins with Renaiss before use. Gacha and marketplace never use a wallet access token. paths: /v2/auth/wallet/verify: post: tags: - Wallet access tokens summary: Get a wallet access token and a refresh token description: >- Exchange the original sign-in message and the wallet’s `personal_sign` signature for an access token and a refresh token. requestBody: required: true content: application/json: schema: type: object properties: challengeId: type: string format: uuid message: type: string minLength: 1 maxLength: 8192 signature: type: string maxLength: 132 required: - challengeId - message - signature additionalProperties: false responses: '200': description: Success content: application/json: schema: type: object properties: tokenType: type: string enum: - Bearer accessToken: type: string refreshToken: type: string expiresAt: type: string format: date-time refreshExpiresAt: type: string format: date-time scopes: type: array items: type: string required: - tokenType - accessToken - refreshToken - expiresAt - refreshExpiresAt - scopes '400': description: >- The request was refused before anything happened. A body that is not valid JSON is refused with a plain-text 400. See [error codes and recovery](/api-reference/auth/verify-message#http-errors). content: text/plain: schema: type: string example: Malformed JSON in request body application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_INVALID_INPUT required: - error - code example: error: Invalid authentication input code: API_AUTH_INVALID_INPUT '401': description: >- The builder key or the credential in the request is not accepted. See [error codes and recovery](/api-reference/auth/verify-message#http-errors). content: application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_INVALID_CREDENTIAL - API_AUTH_MISSING_CREDENTIAL required: - error - code example: error: Invalid authentication credential code: API_AUTH_INVALID_CREDENTIAL '403': description: >- The builder key is not allowed to make this request. See [error codes and recovery](/api-reference/auth/verify-message#http-errors). content: application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_CREDENTIAL_NOT_ALLOWED - GACHA_V3_BUILDER_NOT_ACCEPTED_ON_PUBLIC_API required: - error - code example: error: Credential is not allowed by this policy code: API_AUTH_CREDENTIAL_NOT_ALLOWED '429': description: >- Too many requests with this builder key. See [error codes and recovery](/api-reference/auth/verify-message#http-errors). content: application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string enum: - API_AUTH_RATE_LIMITED required: - error - code example: error: Authentication rate limit exceeded code: API_AUTH_RATE_LIMITED '500': description: >- A failure on our side. Retry later. See [error codes and recovery](/api-reference/auth/verify-message#http-errors). content: text/plain: schema: type: string example: Internal Server Error application/json: schema: type: object properties: error: type: string description: A short sentence about what went wrong. code: type: string required: - error - code example: error: Internal server error code: FUNCTION_ERROR security: - builderAuth: [] components: securitySchemes: builderAuth: type: apiKey in: header name: x-builder-api-key description: >- Your approved builder API key. Keep it on your backend. Gacha and marketplace writes also require wallet action signatures. Redeem also needs a wallet access token, a Bearer token the API issues after the wallet signs a sign-in message. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.