AXIA Reference App
Public API only. A session JWT identifies a user; it does not authorize a root-wallet action. Create wallet opens the trusted confirmation origin as a popup (not an iframe), registers the public key with the session, then POSTs /wallets with device PoP and no Bearer — one create per dashboard Supported wallets family (EVM and Solana are separate roots). Sign message uses the same device PoP. Pick a wallet from the list to sign.
Each wizard button sends its own traceparent. Two users in one org (or two clicks) get different trace ids. Run all still joins every scripted step under one trace.
Project
Claimed from the API key. Environments are not selected by hand — sandbox is used when present.
Environment
Login
Choose a method this project offers. Only that method's form is shown. A session JWT identifies; it does not authorize mint.
Continue with Google
SIWE identifies an EVM address. The login signature is not authorization (ADR-008). Paste a signature, or use a browser wallet for personal_sign.
Challenge message
SIWS identifies a Solana address. The login signature is not authorization (ADR-008).
Challenge message
Link identities (two unused proofs)
Explicit link (AX-P1-M02-T05): open each method, start a proof, do not verify. Same display email never silently merges. Google linking is on the API; this page uses Email + SIWE/SIWS.
Provider A
email
siwe
siws
Provider B
siwe
email
siws
Start link
Complete link
Session JWT
Refresh token
Refresh rotates the session JWT. Reuse of a consumed refresh token revokes the family. Neither token authorizes wallets.
Use session
Refresh session
Load JWKS
Wallet
Create POSTs one wallet per dashboard Supported wallets flag. One EVM wallet covers Ethereum, BNB, and other EVM chains; Solana is a second wallet with its own root. The list below is every wallet this device owns (EVM first). Get address prints every family and the counterfactual Safe (EVM). Sign uses the selected row EOA.
no wallets loaded yet
The private key stays on that origin. Parent messages are enroll / health / sign-pop only. This page must be in the origin's axia-parent-origins allowlist.
Create wallet
Address and signature
Get address
Message to sign (UTF-8; EVM = EIP-191 personal_sign, Solana = raw Ed25519)
Sign message posts device PoP with no Bearer against the selected wallet (click EVM or Solana in the list). A session JWT here is 403 AUTH_LOGIN_NOT_AUTHORIZATION.
Sign message
Verify signature