Function: buildAccessProof()

buildAccessProof(opts): Promise<string>

Defined in: proof.ts:308

Sign a challenge and assemble the encoded access-proof token to hand to the gateway as its auth bearer (e.g. an upload-relay client's auth-token option, an Authorization header).

The signed message binds the gateway's origin, the gate, the network and — for a single-use gateway — the consume digest, so the token is useless anywhere else. Pass consumeDigest exactly when the gateway runs single-use (it rebuilds the message the same way).

Everything a gateway would refuse is checked BEFORE the wallet is asked to sign, so the user is never prompted for a proof that cannot work: the gateway URL, gate, network, nonce, consume digest, the address (0x + 1–64 hex digits, as encodeAccessProof requires) and the challenge's expiry. A challenge counts as expired once Date.now() is more than CHALLENGE_CLOCK_SKEW_MS past expiresAt; the gateway's clock stays the authority. Only the signature the wallet returns is checked afterwards.

Parameters

opts

address

string

challenge

Challenge

consumeDigest?

string

Single-use gateways only: the consume transaction digest.

gateId

string

The Gate the gateway guards (0x + 64 lower-case hex).

gateway

string

The gateway URL the challenge was fetched from (the same string given to fetchChallenge).

network

SuiNetwork

sign

PersonalMessageSigner

Returns

Promise<string>

Throws

if an input is not in its canonical form, the challenge has expired, or the wallet signer rejects or fails.