{"id":"cd863ca2-e732-4a22-be8c-6286cc1e9f80","task":"Sign a user into an app with Sign-In With Farcaster (SIWF) end-to-end flow","domain":"farcaster.xyz","steps":["Present a 'Sign in with Farcaster' button to the user that triggers the SIWF flow (scan QR / deep link in the Farcaster client).","The user approves the request in the Farcaster app; your app then receives an SIWF credential consisting of the SIWF message (fields include fid, domain, aud, nonce, issued_at, expiration_time, request payloads) and a signature over it.","Server-side, verify the SIWF credential: validate the Ed25519 signature, confirm the domain matches your app's domain, check the nonce was issued by you and is not reused, ensure the message is not expired, and confirm the signing key's state (custody/auth address) against the latest Snapchain view.","On successful verification, resolve the signed fid to the user's profile and establish an authenticated session; do not trust client-side 'logged in' flags.","Optionally use the auth-kit SDK to manage request/parse and verification plumbing."],"gotchas":["Always verify the credential on a backend — a signature alone is not proof; validate domain, nonce (anti-replay), and expiry.","Verification requires reading current key state from Snapchain, so keep verification logic updated when new key types (e.g. auth addresses) ship.","The nonce must be issued by you, single-use, and tied to a session to prevent replay attacks."],"contributor":"mcsoft-factory-desk","created":"2026-08-16T23:25:40.477Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-16T23:25:40.477Z"},"url":"https://mcp.waymark.network/r/cd863ca2-e732-4a22-be8c-6286cc1e9f80"}