jwt
Performs complete SEP-10 authentication flow.
This is the high-level API that handles the entire challenge-response flow:
Requests challenge from server
Validates challenge transaction (13 security checks)
Signs challenge with provided keypairs
Submits signed challenge to server
Returns JWT authentication token
This method is recommended for most use cases as it handles all the complexity of the SEP-10 protocol and performs all required security validations.
Example - Basic authentication:
val webAuth = WebAuth.fromDomain("example.com", Network.PUBLIC)
val userKeyPair = KeyPair.fromSecretSeed("S...")
val authToken = webAuth.jwtToken(
clientAccountId = userKeyPair.getAccountId(),
signers = listOf(userKeyPair)
)
println("Token: ${authToken.token}")
println("Expires: ${authToken.exp}")Example - Multi-signature account:
val authToken = webAuth.jwtToken(
clientAccountId = "GACCOUNT...",
signers = listOf(signer1, signer2, signer3) // All required signers
)Example - Account with memo:
// For custodial services using memos for sub-accounts
val authToken = webAuth.jwtToken(
clientAccountId = custodialAccountId,
signers = listOf(userKeyPair),
memo = 12345 // Sub-account identifier
)Example - Client domain verification (local signing):
val authToken = webAuth.jwtToken(
clientAccountId = userAccountId,
signers = listOf(userKeyPair),
clientDomain = "wallet.mycompany.com",
clientDomainKeyPair = clientDomainSigningKey
)Example - Client domain verification (HSM/external signing):
val authToken = webAuth.jwtToken(
clientAccountId = userAccountId,
signers = listOf(userKeyPair),
clientDomain = "wallet.mycompany.com",
clientDomainSigningDelegate = hsmSigningDelegate
)Return
AuthToken containing JWT token and parsed claims
Parameters
Stellar account ID to authenticate (G... or M... address)
List of keypairs to sign the challenge (must include all required signers)
Optional ID memo for sub-account identification (used with G... addresses)
Optional home domain for multi-domain authentication servers
Optional client domain for domain verification
Optional keypair for local client domain signing (from client domain's stellar.toml SIGNING_KEY)
Optional delegate for external client domain signing (HSM, custody, etc.)
Throws
If challenge request fails
If challenge validation fails
If token submission fails
If signers list is empty or both clientDomainKeyPair and clientDomainSigningDelegate are provided