Sign-in

A wallet signs a message. The server sets a cookie. There are no passwords.

POST /auth/nonce

Body: { "address": "0x..." }

{
  "nonce": "b3J5...",
  "message": "dovejournal.com wants you to sign in to The Dove Journal with your wallet:\n0x...\n\nSign this message to prove you control this wallet. No transaction, no gas.\n\nNonce: b3J5..."
}

The nonce is valid for 10 minutes and can be used once.

POST /auth/verify

Body: { "address": "0x...", "nonce": "...", "signature": "0x..." }

Sign message exactly as returned, with personal_sign. Smart-contract wallets are supported. On success the response sets the dj_session cookie: HTTP-only, 30 days.

Status	When
200	{ "address": "0x..." }
401	The signature did not verify, or the nonce was used or expired

GET /me

{ "address": "0x..." }, or { "address": null } when signed out.

POST /auth/logout

Clears the cookie.

Buying signs you in

A settled purchase sets the same cookie for the wallet that paid, so a reader or an agent does not have to sign in first.