-
Describe your issue or question:
-
Which platform or framework are you using (e.g., React, Vue, Android, iOS, Unity, Node, etc.)?
-
Which Web3Auth/ Embedded Wallet SDK (SDK Name and version) are you using?
-
What is not working as expected?
-
-
Code snippets: Include the portion of your code that is causing problems.
-
Exact error and logs: Copy any error messages or console logs.
-
Package details: Note versions for Web3Auth/MetaMask Embedded Wallets and any related packages.
What is this discussion about in one brief sentence?
api-wallet.web3auth.io/auth/verify returns 400 Bad Request because v10.15.0 generates signatures longer than the server’s 500-character limit.
Describe your issue or question:
After upgrading @web3auth/modal and @web3auth/no-modal from 10.14.1 to 10.15.0, social login (Google) completely breaks with
a 400 Bad Request from Web3Auth’s own verification server. Downgrading back to 10.14.1 fixes it.
Which platform or framework are you using?
React (Vite + TypeScript)
Which Web3Auth SDK (name and version)?
- @web3auth/modal@10.15.0 (broken)
- @web3auth/modal@10.14.1 (works)
- @web3auth/no-modal@10.15.0 (broken)
- @web3auth/account-abstraction-provider@9.7.0
- permissionless@0.3.4
What is not working as expected?
After Google OAuth completes, Web3Auth internally calls POST https://api-wallet.web3auth.io/auth/verify and receives a 400
Bad Request. Login fails entirely. This did NOT happen on 10.14.1.
Exact error and logs:
POST https://api-wallet.web3auth.io/auth/verify
Status: 400 Bad Request
Response body:
{
“statusCode”: 400,
“error”: “Bad Request”,
“message”: “Validation failed”,
“validation”: {
“body”: {
“source”: “body”,
“keys”: [“signatures.0”],
“message”: ““signatures[0]” length must be less than or equal to 500 characters long”
}
}
}
The signatures array in the request body contains JSON strings like:
“{“data”:“eyJleHAiOjE3NzU5MDk3NDEs…(truncated)”,“sig”:“7b129e2f…”}”
In v10.15.0 the data field (base64-encoded JWT) includes additional fields, pushing each stringified signature object over
500 characters. The server’s validation still enforces the old <= 500 limit.
Code snippets:
No user code change needed — this is triggered purely by the SDK version bump. Standard init:
const web3auth = new Web3Auth({
clientId,
chains: [chainConfig],
web3AuthNetwork: WEB3AUTH_NETWORK.SAPPHIRE_MAINNET,
accountAbstractionConfig: {
smartAccountType: “safe”,
chains: [{ chainId: “0x2105”, bundlerConfig: { url: bundlerUrl }, paymasterConfig: { url: paymasterUrl } }],
},
});
await web3auth.init();
await web3auth.connectTo(“auth”, { authConnection: “google” });
Package details:
┌────────────────────────────────────────┬─────────┬─────────┐
│ Package │ Broken │ Working │
├────────────────────────────────────────┼─────────┼─────────┤
│ @web3auth/modal │ 10.15.0 │ 10.14.1 │
├────────────────────────────────────────┼─────────┼─────────┤
│ @web3auth/no-modal │ 10.15.0 │ 10.14.1 │
├────────────────────────────────────────┼─────────┼─────────┤
│ @web3auth/account-abstraction-provider │ 9.7.0 │ 9.7.0 │
└────────────────────────────────────────┴─────────┴─────────┘
Workaround: Pin to 10.14.1 (exact, no caret) until the server-side validation limit is increased to match the new signature
length.