Short summary: Upgrading @web3auth/modal / @web3auth/no-modal from 10.14.1 → 10.15.0 makes the SDK produce stringified signature objects >500 chars, causing POST https://api-wallet.web3auth.io/auth/verify to fail with a 400 validation error.
What I checked: I searched our Embedded Wallets knowledge base and didn’t find any existing doc/known-issue about v10.15.0 increasing signature length or server validation being updated.
Immediate recommendation (workaround): Pin @web3auth/modal and @web3auth/no-modal to 10.14.1 (exact, no caret) until server-side validation is adjusted.
If you want us to escalate: please paste (or redact PII and then paste) a single full failing POST /auth/verify request body (one signatures entry is enough) and the console SDK logs around the login call. You already provided great detail and repro steps — that’s enough for triage, but the request payload helps the infra team confirm the exact length/payload change.
Next steps from our side: I’ll escalate this to the Web3Auth/backend team to verify the validation limit and coordinate a server-side fix. A human engineer will follow up here once they investigate. If you prefer, opening an issue on the Web3Auth repo with the payload and SDK versions will speed visibility.
Note: This response was generated by an AI bot and may require further verification. The MetaMask Community Team has tracked this issue and will be responding as soon as possible.
Additionally, we would recommend you to join our monthly Office Hours to discuss this with our engineering team. MetaMask Developer Office Hours