Authentication

Auth Flow

SuperVaults uses Dynamic.xyz for wallet connection and JWT issuance.

Connect Wallet

Open os.superform.xyz and click Connect Wallet. Dynamic.xyz presents a wallet selection modal supporting MetaMask, Rabby, WalletConnect, and others.

Sign Auth Message

Your wallet signs a non-transactional message. Dynamic.xyz verifies the signature and issues a JWT tied to your wallet address.

JWT Stored in Browser

SuperformOS stores auth state in localStorage:

curator_jwt — the Bearer token used on all API requests
curator_address — connected wallet address
curator_is_manager — boolean flag
curator_vaults — array of vault addresses you operate

Auth Verified

The app calls GET /api/v1/auth/me on load to fetch your vault roles and confirm the JWT is valid.

Primary Auth Endpoint

GET /api/v1/auth/me
Authorization: Bearer <your-jwt>

Returns the current user with all assigned vault roles. Use this endpoint when building integrations. Response:

{
  "wallet_address": "0xabc...",
  "is_manager": true,
  "vaults": [
    {
      "vault_address": "0xdef...",
      "chain_id": 8453,
      "role": "primary_manager"
    }
  ]
}

GET /api/v1/auth/me returns the current user with all assigned vault roles. Use this endpoint when building integrations.

JWT Verification Endpoint

GET /api/v1/auth/verify
Authorization: Bearer <your-jwt>

Returns:

{
  "verified": true,
  "walletAddress": "0xabc...",
  "isManager": true,
  "vaults": ["0xdef..."]
}

Token Lifecycle

JWTs expire after a session period defined by Dynamic.xyz
Any 401 Unauthorized from Erebor triggers automatic logout via authService.handleAutoLogout()
Reconnecting your wallet re-issues a fresh JWT

Public Endpoints (No Auth)

Endpoint	Description
`GET /api/v1/public/vaults`	All SuperVault deployments with TVL and APY
`GET /api/v1/registry/token-assets`	Token asset metadata

Programmatic Authentication

For automation scripts, generate a JWT without the browser:

Sign an EIP-712 auth message with your wallet’s private key
Submit the signature to Dynamic.xyz to receive a JWT
Pass the JWT as Authorization: Bearer <your-jwt> on all requests

import requests

EREBOR_URL = "https://erebor.superform.xyz"
JWT = "<your-jwt>"

headers = {"Authorization": f"Bearer {JWT}"}

resp = requests.get(f"{EREBOR_URL}/api/v1/auth/me", headers=headers)
resp.raise_for_status()
user = resp.json()

print(f"Connected as: {user['wallet_address']}")
print(f"Manages {len(user['vaults'])} vault(s)")

const EREBOR_URL = "https://erebor.superform.xyz";
const JWT = "<your-jwt>";

const headers = { Authorization: `Bearer ${JWT}` };

const resp = await fetch(`${EREBOR_URL}/api/v1/auth/me`, { headers });
if (!resp.ok) throw new Error(`Auth failed: ${resp.status}`);

const user = await resp.json();
console.log(`Connected as: ${user.wallet_address}`);
console.log(`Manages ${user.vaults.length} vault(s)`);

Never hardcode JWTs in source code. Use environment variables (for example, SUPERFORMOS_JWT) and rotate tokens regularly. JWTs grant full manager-level access to your vaults.

Getting Started

Vault Setup

Vault Operations

Access & Settings

Distribution

Safety & Incident Response

Automation

API Reference

Auth Flow

Primary Auth Endpoint

JWT Verification Endpoint

Token Lifecycle

Public Endpoints (No Auth)

Programmatic Authentication

​Auth Flow

​Primary Auth Endpoint

​JWT Verification Endpoint

​Token Lifecycle

​Public Endpoints (No Auth)

​Programmatic Authentication

Auth Flow

Primary Auth Endpoint

JWT Verification Endpoint

Token Lifecycle

Public Endpoints (No Auth)

Programmatic Authentication