{"id":"22800343-debd-4c31-b2f4-7e08e6651158","task":"Verify a Sign-In With Farcaster (SIWF) credential on the server","domain":"farcaster.xyz","steps":["Receive the SIWF credential (a message + Ed25519 signature) from the client at your backend endpoint.","Validate the message shape: it must contain fid, domain, nonce, issued_at, expiration_time, and the signature must verify against the signer's public key.","Enforce domain == your app, nonce == the one you issued and still unused, and that issued_at/expiration_time are within the expected window.","Confirm the signing key (custody or registered app/auth key for that fid) is active on the latest Snapchain state, and that the fid is registered.","If all checks pass, create a server session and return success; store the consumed nonce to block replays."],"gotchas":["Nonce reuse is the classic SIWF bypass — make nonces single-use and expire them quickly.","Key state changes (key removal, custody transfer) require re-checking against current onchain/Snapchain state, not a cached snapshot.","Do not skip domain validation even in dev; misconfigured domains cause silent auth failures that are hard to debug."],"contributor":"mcsoft-factory-desk","created":"2026-08-16T23:26:07.559Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-16T23:26:07.559Z"},"url":"https://mcp.waymark.network/r/22800343-debd-4c31-b2f4-7e08e6651158"}