Console API — Auth

Sign-in and session endpoints behind the Triport console: email and Google OAuth flows, wallet challenge/verify (EVM, Solana), linked wallets (list, link), session lookup (me), attribution and logout.

Method / Endpoint
https://triport.io/v1/auth/…
Network
— (account-level)
Authentication
Console session — see session model
Tier / rate limit
Account-level; not metered against chain RPS budgets

What this section covers

How a console session is created and inspected: start/verify an email sign-in, complete the Google OAuth round-trip, or prove wallet ownership with a signed challenge. An account has at most one linked wallet per chain family (EVM, Solana) — the only wallet allowed to pay in-app invoices; wallets lists it and wallet/link adds one. Changing or removing a linked wallet is done by support (the self-service wallet/replace and the batch endpoints were removed on 2026-09-29 and answer 410 endpoint_removed). me returns the current account; attribute binds a referral code to it; logout ends the session. The session model page explains cookies, lifetimes and CSRF rules shared by all of these.

The endpoint list is below; every page carries the request/response schema, error envelope and a runnable example. Part of the Console API.

GET GET /v1/auth/google/callback
Browser-facing OAuth callback that completes the Google sign-in dance, issues a console session, and redirects into the app.
GET GET /v1/auth/google/start
Begins the Google OAuth sign-in flow by redirecting the browser to Google's consent screen.
GET GET /v1/auth/me
Returns the currently authenticated console user, their primary sign-in provider, and their default API key — bootstrapping that key on first login.
GET GET /v1/auth/wallets
List the wallets linked to the signed-in account — at most one per chain family (EVM, Solana).
POST POST /v1/auth/attribute
Attributes the freshly-signed-in console user to the referrer recorded in their ref_code cookie — best-effort, always returns 200.
POST POST /v1/auth/email/start
Begins email one-time-password (OTP) login by sending a 6-digit code to the supplied address and returning a request_id to use in the verify step.
POST POST /v1/auth/email/verify
Completes the email one-time-passcode (OTP) login flow: verifies the code, opens an authenticated console session, and returns the signed-in user.
POST POST /v1/auth/logout
Revokes the current console session and clears the nl_session cookie.
POST POST /v1/auth/wallet/challenge
Request a single-use nonce and the exact human-readable message a wallet must sign — for sign-in, or for linking a wallet to your account.
POST POST /v1/auth/wallet/link
Attach a wallet to the account you are signed in to, proving ownership with a signed link challenge. One wallet per chain family.
POST POST /v1/auth/wallet/verify
Verify a wallet signature against a previously issued challenge nonce, then open an authenticated console session.
Session and CSRF model
How the Triport console authenticates browser requests: an opaque