---
title: "Authenticate wallet session scoped to intents"
method: POST
path: "/v1/wallets/authenticate/intents"
tags: ["Wallets"]
---

# Authenticate wallet session scoped to intents

`POST /v1/wallets/authenticate/intents`

Exchange a user JWT for a session key scoped to specific intents. The returned USK can only authorize the bound intents and cannot sign other RPC requests.

## Headers

- `privy-app-id` string, required — ID of your Privy app.

## Request body

- union — Request body for creating a user signing key scoped to specific bindings. The returned USK can only authorize the bound values and cannot sign other RPC requests.
  - object — Request body for creating an encrypted, bound user signing key.
    - `bindings` UserSigningKeyBinding[], required — Bindings that scope the USK. The key can only authorize the bound values.
      - `intentId` string, required
      - `type` 'intent', required
    - `encryption_type` 'HPKE', required
    - `recipient_public_key` string, required
    - `user_jwt` string, required
  - object — Request body for creating an unencrypted, bound user signing key.
    - `bindings` UserSigningKeyBinding[], required — Bindings that scope the USK. The key can only authorize the bound values.
      - `intentId` string, required
      - `type` 'intent', required
    - `user_jwt` string, required

## Response `200`

Object with authorization key, wallet IDs, and the bindings the key is scoped to.

- union — The response from authenticating a wallet with intent bindings, containing an authorization key, wallet data, and the bindings the key is scoped to.
  - object — Encrypted response from bound wallet authentication, with bindings.
    - `bindings` UserSigningKeyBinding[], required
      - `intentId` string, required
      - `type` 'intent', required
    - `encrypted_authorization_key` EncryptedAuthorizationKey, required — HPKE-encrypted authorization key with encapsulated key and ciphertext.
      - `ciphertext` string, required — The encrypted authorization key corresponding to the user's current authentication session.
      - `encapsulated_key` string, required — Base64-encoded ephemeral public key used in the HPKE encryption process. Required for decryption.
      - `encryption_type` 'HPKE', required — The encryption type used. Currently only supports HPKE.
    - `expires_at` number, required
    - `wallets` Wallet[], required
      - `additional_signers` WalletAdditionalSignerItem[], required — Additional signers for the wallet.
        - `override_policy_ids` string[] — An optional list of up to one policy ID to enforce on the wallet.
        - `signer_id` string, cuid2, required — A unique identifier for a key quorum.
      - `address` string, required — Address of the wallet.
      - `archived_at` number, nullable — Unix timestamp of when the wallet was archived in milliseconds, or null if the wallet is active.
      - `authorization_threshold` number — The number of keys that must sign for an action to be valid.
      - `chain_type` 'ethereum' | 'solana' | 'cosmos' | 'stellar' | 'sui' | 'aptos' | 'movement' | 'tron' | 'bitcoin-segwit' | 'bitcoin-taproot' | 'pearl' | 'near' | 'ton' | 'starknet' | 'spark', required — The wallet chain types.
      - `created_at` number, required — Unix timestamp of when the wallet was created in milliseconds.
      - `custody` WalletCustodian — Information about the custodian managing this wallet.
        - `provider` string, required — The custodian responsible for the wallet.
        - `provider_user_id` string, required — The resource ID of the beneficiary of the custodial wallet.
      - `display_name` string — A human-readable label for the wallet.
      - `exported_at` number, nullable, required — Unix timestamp of when the wallet was exported in milliseconds, if the wallet was exported.
      - `external_id` string — A customer-provided identifier for mapping to external systems. Write-once, set only at creation.
      - `id` string, required — Unique ID of the wallet. This will be the primary identifier when using the wallet in the future.
      - `imported_at` number, nullable, required — Unix timestamp of when the wallet was imported in milliseconds, if the wallet was imported.
      - `owner_id` string, cuid2, nullable, required — The key quorum ID of the owner of the wallet.
      - `policy_ids` string[], required — List of policy IDs for policies that are enforced on the wallet.
      - `public_key` string — The compressed, raw public key for the wallet along the chain cryptographic curve.
  - object — Unencrypted response from bound wallet authentication, with bindings.
    - `authorization_key` string, required
    - `bindings` UserSigningKeyBinding[], required
      - `intentId` string, required
      - `type` 'intent', required
    - `expires_at` number, required
    - `wallets` Wallet[], required
      - `additional_signers` WalletAdditionalSignerItem[], required — Additional signers for the wallet.
        - `override_policy_ids` string[] — An optional list of up to one policy ID to enforce on the wallet.
        - `signer_id` string, cuid2, required — A unique identifier for a key quorum.
      - `address` string, required — Address of the wallet.
      - `archived_at` number, nullable — Unix timestamp of when the wallet was archived in milliseconds, or null if the wallet is active.
      - `authorization_threshold` number — The number of keys that must sign for an action to be valid.
      - `chain_type` 'ethereum' | 'solana' | 'cosmos' | 'stellar' | 'sui' | 'aptos' | 'movement' | 'tron' | 'bitcoin-segwit' | 'bitcoin-taproot' | 'pearl' | 'near' | 'ton' | 'starknet' | 'spark', required — The wallet chain types.
      - `created_at` number, required — Unix timestamp of when the wallet was created in milliseconds.
      - `custody` WalletCustodian — Information about the custodian managing this wallet.
        - `provider` string, required — The custodian responsible for the wallet.
        - `provider_user_id` string, required — The resource ID of the beneficiary of the custodial wallet.
      - `display_name` string — A human-readable label for the wallet.
      - `exported_at` number, nullable, required — Unix timestamp of when the wallet was exported in milliseconds, if the wallet was exported.
      - `external_id` string — A customer-provided identifier for mapping to external systems. Write-once, set only at creation.
      - `id` string, required — Unique ID of the wallet. This will be the primary identifier when using the wallet in the future.
      - `imported_at` number, nullable, required — Unix timestamp of when the wallet was imported in milliseconds, if the wallet was imported.
      - `owner_id` string, cuid2, nullable, required — The key quorum ID of the owner of the wallet.
      - `policy_ids` string[], required — List of policy IDs for policies that are enforced on the wallet.
      - `public_key` string — The compressed, raw public key for the wallet along the chain cryptographic curve.

---

[API](https://skmtc.net/privy-io/apis/privy-api.md) · [All operations](https://skmtc.net/privy-io/apis/privy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/privy-io/privy-api/revisions/bb2eb34156cc/schema)