Signed wallet authentication
Wallet login creates a short-lived challenge bound to the wallet address, nonce, origin, and expiration. The wallet signs the message, the server verifies the signature, and the challenge is consumed once to prevent replay.
- Request an expiring challenge
- Review and sign the message
- Verify address and signature
- Consume the challenge once
Password and session handling
Passwords are hashed with Argon2id and are not stored as readable credentials. Successful login creates an opaque session identifier stored server-side and delivered through a secure, HTTP-only cookie.
Linked identity controls
Accounts can link supported login methods. Removal rules protect against leaving an account without a usable identity, and sensitive operations require an authenticated session.
- Email and password identity
- Signed Solana wallet identity
- Unique identity ownership
- At least one login method retained
Your security responsibilities
PumpCopy never needs your seed phrase or private key. Protect your devices, review wallet signature messages, use unique credentials, and disconnect sessions you do not recognize.
- Never share a seed phrase
- Verify the domain before signing
- Keep wallet software updated
- Report suspected account access
No absolute security claim
Software, browsers, wallets, dependencies, networks, and users can fail. Security controls require ongoing maintenance, and crypto activity can still expose you to phishing, malicious tokens, compromised devices, and protocol risk.