On this page

Signing

Call enable() before using the dApp API. Addresses returned by the CIP-30 API are hex-encoded bytes; transaction and value parameters are hex-encoded CBOR. Browser examples using Buffer require an explicit buffer import or a byte conversion helper.

Learn how to sign data for authentication on Cardano.

Sign Data (CIP-8)

Sign arbitrary data for authentication:


const api = await window.cardano.onekey.enable()
 
const addresses = await api.getUsedAddresses()
const address = addresses[0]
 
// Message to sign
const payload = Buffer.from('Hello Cardano!').toString('hex')
 
const signature = await api.signData(address, payload)
 
console.log({
  signature: signature.signature, // COSE_Sign1 signature
  key: signature.key,             // COSE_Key public key
})

Verify Signature


import { COSESign1, COSEKey } from '@emurgo/cardano-message-signing-browser'
 
const coseSign1 = COSESign1.from_bytes(
  Buffer.from(signature.signature, 'hex')
)
const coseKey = COSEKey.from_bytes(
  Buffer.from(signature.key, 'hex')
)
 
// Get the signed payload
const signedPayload = coseSign1.payload()
 
// Verify signature
// Parsing COSE is not verification. Use a CIP-8 verifier to check the
// protected headers, signing structure, payload, signature, and address binding.

Error Handling


try {
  const api = await window.cardano.onekey.enable()
} catch (error) {
  if (error.code === -3) {
    console.log('The wallet refused the request')
  } else if (error.code === -4) {
    console.log('The account changed; reconnect and retry')
  } else {
    console.error('Error:', error.message)
  }
}

Common Errors

Code	Description
-1	Invalid request
-2	Internal error
-3	Refused request
-4	Account changed