---
title: "Exchange a wallet signature for a JWT bearer token"
method: POST
path: "/auth:exchange"
tags: ["Auth"]
---

# Exchange a wallet signature for a JWT bearer token

`POST /auth:exchange`

Verify an EIP-191 `personal_sign` signature and issue a JWT bound to
the signer's EOA. The signed message must use the canonical template
with the EigenLayer registration chain ID (not the workflow target
chain). SDKs construct the message locally — there is no
`GetSignatureFormat` endpoint.

## Request body

- AuthExchangeRequest
  - `ownerAddress` string, required — Lowercase or checksummed hex EOA / contract address.
  - `signature` string, required — Arbitrary-length hex-encoded byte string.
  - `message` string, required — The plain-text message that was signed. Must use the canonical format with the EigenLayer registration chain ID (NOT the workflow target chain). SDKs generate this locally.

## Response `200`

Authentication succeeded; token issued.

- AuthExchangeResponse
  - `token` string, required — JWT bearer token.
  - `expiresAt` string, date-time, required — RFC 3339 timestamp.
  - `subject` string — Lowercase or checksummed hex EOA / contract address.

## Other responses

- `400` — Request validation failed.
- `401` — Missing or invalid bearer token.
- `429` — Rate limit exceeded. Inspect `X-RateLimit-Reset` for the next allowed request time and `Retry-After` for the seconds to wait.

---

[API](https://skmtc.net/avaprotocol/apis/ava-protocol-avs-api.md) · [All operations](https://skmtc.net/avaprotocol/apis/ava-protocol-avs-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/avaprotocol/ava-protocol-avs-api/revisions/caa86e825f53/schema)