1. Failing POST …/auth/verify request body (JSON, redacted)
URL: https://api-wallet.web3auth.io/auth/verify
Method: POST
Content-Type: application/json
{
“public_address”: “0x4470…2A3510”,
“id_token”: “<REDACTED — ES256 JWT from api-auth.web3auth.io; length 1774 characters; three dot-separated segments>”,
“verifier”: “web3auth-google-sapphire”,
“verifier_id”: “s***@hotmail.com”,
“account_type”: “account_abstraction”,
“chain_namespace”: “eip155”,
“email”: “s***@hotmail.com”,
“signatures”: [
“<REDACTED — stringified JSON with \“data\” (base64) + \“sig\” (hex); length ~575 — exceeds 500>”,
“<REDACTED — same structure; length ~575>”,
“<REDACTED — same structure; length ~575>”
],
“network”: “mainnet”,
“eoa_address”: “0x3BD1…f8C7A1e”,
“aa_provider”: “safe”,
“chain_id”: “0x89”
}
Encoding note: Each signatures[i] value is a stringified JSON object. The inner data field is base64; sig is hex. Each whole signatures[i] string is > 500 characters, which triggers validation.
2. Full HTTP response (status, body, headers)
Status: 400 Bad Request
Response body:
{
“statusCode”: 400,
“error”: “Bad Request”,
“message”: “Validation failed”,
“validation”: {
“body”: {
“source”: “body”,
“keys”: [“signatures.0”],
“message”: “\“signatures[0]\” length must be less than or equal to 500 characters long”
}
}
}
Response headers (as captured):
HTTP/1.1 400 Bad Request
Date: Sat, 11 Apr 2026 01:43:29 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 221
Connection: keep-alive
Access-Control-Allow-Origin: https://wallet.web3auth.io
Vary: Origin, Accept-Encoding
Access-Control-Allow-Credentials: true
Content-Security-Policy: default-src ‘self’;base-uri ‘self’;font-src ‘self’ https: data:;form-action ‘self’;frame-ancestors ‘self’;img-src ‘self’ data:;object-src ‘none’;script-src ‘self’;script-src-attr ‘none’;style-src ‘self’ https: ‘unsafe-inline’;upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: no-referrer
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 0
RateLimit-Policy: 10;w=60
RateLimit-Limit: 10
RateLimit-Remaining: 9
RateLimit-Reset: 60
ETag: W/“dd-0EOTbHPa7UKks/AMgpmf20pwQOo”
3. Timestamp + redacted curl
Incident time (UTC): 2026-04-11 01:43:29 UTC (from Date response header)
curl ‘https://api-wallet.web3auth.io/auth/verify’ \
-H ‘Accept: */*’ \
-H ‘Content-Type: application/json; charset=utf-8’ \
-H ‘Origin: https://wallet.web3auth.io’ \
-H ‘Referer: https://wallet.web3auth.io/’ \
-H ‘x-api-key: torus-default’ \
-H ‘baggage: ’ \
-H ‘sentry-trace: ’ \
--data-raw ‘{“public_address”:“0x4470…2A3510”,“id_token”:“<REDACTED, length 1774>”,“verifier”:“web3auth-google-sapphire”,“verifier_id”:“s***@hotmail.com”,“account_type”:“account_abstraction”,“chain_namespace”:“eip155”,“email”:“s***@hotmail.com”,“signatures”:[“<REDACTED, length ~575>”,“”,“”],“network”:“mainnet”,“eoa_address”:“0x3BD1…f8C7A1e”,“aa_provider”:“safe”,“chain_id”:“0x89”}’
Context: Origin / Referer are https://wallet.web3auth.io — hosted wallet context, not our dapp origin.
4. AA vs EOA (summary)
I did not change production. Minimal test app (HTML/Vite), fresh deps.
-
AA / smart account on: POST …/auth/verify → 400, signatures[0] length limit — cannot complete login.
-
AA off: same embedded-wallet social login succeeds (EOA only); no account_abstraction failure. No api-wallet…/auth/verify in Network for the same flow (or not the failing payload).
This looks AA-specific relative to the verify payload above.
Thanks for escalating to the backend team.