{"id":"ERC-4361","name":"Sign-In with Ethereum (SIWE)","status":"Final","chain":"both","category":{"id":"onboarding","name":"Onboarding & Access","description":"Getting users into web3 without friction"},"journeyStages":[{"id":"authentication","name":"Authentication & Identity","description":"Proving who you are and logging in"}],"uxImpact":"Users sign in to websites using their Ethereum wallet instead of email/password — self-custodied identity with no centralized IdP. Design implications: display human-readable SIWE message showing domain, statement, URI, chain ID, nonce, and expiration; design clear 'Sign-In with Ethereum' buttons distinct from transaction signing; show ENS names and avatars when available; implement session management with expiration handling. Design decisions: decide session duration and refresh strategy, choose between auto-login for returning users vs explicit sign-in, design account switching when user changes wallet address, handle signature rejection gracefully without breaking auth flow, consider showing resources array for granular permission requests.","hasDetailedContent":true,"content":{"id":"ERC-4361","summary":"ERC-4361 is \"Sign-In with Ethereum\" (SIWE). Instead of email/password, users sign a message with their wallet to authenticate. The signature proves wallet ownership without revealing private keys. One wallet = one identity across all supporting apps. No more managing dozens of passwords.","applicability":{"whenToUse":["Your product addresses: every app needs separate account/password.","Your product addresses: password reuse and database breaches.","The flow should deliver: sign message with wallet = instant authentication.","You are designing a sign-in with ethereum button experience with visible states and recovery paths."],"whenToAvoid":["Server verifies domain in message matches request origin.","Clear statement: \"Sign in to [app name]\".","Set reasonable expiration, re-authenticate periodically.","Wallet or chain support is fixed and users cannot choose providers."]},"designerTakeaways":["You can design UI that delivers sign message with wallet = instant authentication.","You can design UI that delivers no password stored anywhere, cryptographic proof.","You can design UI that delivers human-readable message: \"Sign in to app.com at [time]\"."],"problemsSolved":[{"problem":"Every app needs separate account/password","oldWay":"Create account, verify email, remember password, repeat for every site","newWay":"Sign message with wallet = instant authentication","impact":"critical"},{"problem":"Password reuse and database breaches","oldWay":"Passwords stored (hashed) on servers, can be breached","newWay":"No password stored anywhere, cryptographic proof","impact":"high"},{"problem":"Sign-in requests looked like random data","oldWay":"Sign \"0x4f8a3b...\" — what does this even mean?","newWay":"Human-readable message: \"Sign in to app.com at [time]\"","impact":"high"}],"uxPatterns":[{"name":"Sign-In with Ethereum Button","description":"One-click authentication with wallet","mockup":"concept/siwe-sign-in","userFlow":["User clicks \"Sign in with Ethereum\"","Wallet shows sign message popup","User reads and approves message","Server verifies signature","User authenticated + session created"]},{"name":"SIWE Message Preview","description":"What users see in wallet when signing","mockup":"concept/siwe-sign-in","userFlow":["App generates SIWE message","Wallet displays formatted message","User verifies domain matches","User clicks Sign","Signature returned to app"]}],"uiComponents":[{"name":"SIWEButton","description":"Primary sign-in with Ethereum button","states":["idle","connecting","signing","authenticated","error"],"props":["onAuth","domain","statement"]},{"name":"SessionIndicator","description":"Shows authenticated state with session info","states":["anonymous","authenticated","expired"],"props":["address","expiresAt","onSignOut"]},{"name":"DomainBadge","description":"Verified domain indicator in sign message","states":["verified","mismatch","unknown"],"props":["domain","expectedDomain"]}],"antiPatterns":[{"pattern":"Unclear message statement","why":"Users sign without understanding what they're agreeing to","instead":"Clear statement: \"Sign in to [app name]\"","severity":"high"},{"pattern":"No session expiration","why":"Session lives forever, security risk","instead":"Set reasonable expiration, re-authenticate periodically","severity":"high"},{"pattern":"Not verifying domain matches","why":"Phishing sites could capture signatures","instead":"Server verifies domain in message matches request origin","severity":"critical"},{"pattern":"Making SIWE the only auth option","why":"Not everyone has a wallet yet","instead":"Offer email/social as alternatives for onboarding","severity":"medium"}],"onMonad":[{"aspect":"Signature Verification","ethereum":"Chain ID 1 in message","monad":"Use Monad chain ID in message","designImplication":"Update chain ID in SIWE message for Monad users"}],"keyTakeaways":["SIWE = \"Sign in with Ethereum\" — wallet-based auth","Messages must be human-readable with clear statement","Always verify domain matches to prevent phishing","Set session expiration for security","Offer alternatives for users without wallets"],"technicalNotes":"ERC-4361 defines a message format parsed by wallets: domain, address, statement, URI, version, chain ID, nonce, issued-at, and optional expiration/not-before/resources. Server generates message, user signs with personal_sign, server verifies signature matches address in message and nonce matches stored nonce."},"sources":[{"label":"Official specification","url":"https://eips.ethereum.org/EIPS/eip-4361","type":"official-spec"},{"label":"Discussion","url":"https://ethereum-magicians.org/search?q=ERC-4361","type":"discussion"}],"urls":{"canonical":"https://www.eipsfordesigners.com/standards/ERC-4361","markdown":"https://www.eipsfordesigners.com/standards/ERC-4361/content.md","agent":"https://www.eipsfordesigners.com/standards/ERC-4361/agent.md","api":"https://www.eipsfordesigners.com/api/standards/ERC-4361","official":"https://eips.ethereum.org/EIPS/eip-4361","discussion":"https://ethereum-magicians.org/search?q=ERC-4361"},"freshness":{"lastReviewed":"2026-04-05","lastUpdated":"2026-04-05"}}