Accounts and sign in

Your Humanity Ledger account is your wallet address. There is no username and no password. To sign in, you prove that you control the address by signing a message with your wallet.

Signing in with a wallet

We use Sign in with Ethereum, the standard defined in EIP-4361. It works with any wallet that can sign a plain text message.

1. Your browser asks for a nonce

   Our server returns a random value that can be used once. It is stored in a short lived cookie.

2. Your wallet shows the message

   The message names this website, your address, the nonce and the time. Read it before you sign: a message for another site should never be signed here.

3. You sign

   Your wallet signs the message with your private key. The key never leaves the wallet.

4. Our server checks the signature

   The server recovers the address from the signature, checks that the nonce and the domain match, and starts a session.

Signing in with email

If you do not have a wallet yet, you can sign in with an email address. We send a one time code to that address. Some features, such as payments, need a wallet, and the app asks you to link one when you reach them.

To limit abuse, a code can be requested a few times every ten minutes per address and per network, and the form is protected by a bot check from Cloudflare.

Sessions

• A session is stored in a cookie that scripts on the page cannot read.
• It lasts seven days, or until you sign out.
• Our servers never take your identity from anything the browser sends except that cookie. A header or a parameter claiming to be your address is discarded.

If you lose your wallet

Nobody, including us, can recover a wallet for you. If you lose your recovery phrase you lose the account. Conversations stored on a device you still have can be read there, but you cannot sign in again with the lost address.