# Auth/verify fails: signatures\[0\] must be ≤ 500 characters (account abstraction) **URL:** \ **Category:** Embedded Wallets (Web3Auth)\ **Tags:** web3auth, account-abstraction\ **Created:** [April 10, 2026, 4:47pm UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072 "2026-04-10T16:47:02Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Aussie](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/aussie/32/3016_2.png) [@Aussie](https://builder.metamask.io/u/Aussie)\ **Post date:** [April 10, 2026, 4:47pm UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/1 "2026-04-10T16:47:02Z")
Embedded Wallets / Web3Auth was working fine for us, but **starting today** every login hits the wallet **`auth/verify`** call and returns validation errors like: `"signatures[0]" length must be less than or equal to 500 characters long` We’re on **`account_abstraction`** (AA) with the usual id-token flow. **We didn’t change our app or dashboard settings** ; to rule out our code we also tried a **minimal single-page app** with only sign-in, **same error** , separate `node_modules` / lockfile. Versions in `package.json` - `@web3auth/modal`: **10.15.0** - `@web3auth/auth`: **10.8.0** - `@web3auth/ws-embed`: \*\*5.6.0 After OAuth / modal sign-in, the flow hits **`POST https://api-wallet.web3auth.io/auth/verify`** and returns **400** with validation on **`signatures`** : each `signatures[n]` string must be **≤ 500 characters**. With **`account_type`: `account_abstraction`** (and AA / wallet services enabled), the client sends **large** `signatures` entries and the call **fails** , so the user cannot complete login. `accountAbstractionConfig` + social login → `auth/verify` payload includes `signatures[]` strings \> 500 chars → API rejects. Exact error message { “message”: ““signatures[0]” length must be less than or equal to 500 characters long” } Is **`auth/verify`** supposed to accept **MPC `signatures` on the same request as `account_abstraction` + `id_token`** , or if this is a known regression / version mismatch? Thanks in advance ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/metamaskbuilderhub/original/2X/9/92b599d3131e78cf3d3ff01b80e54d69d266f8df.png) [@system](https://builder.metamask.io/u/system)\ **Post date:** [April 10, 2026, 4:48pm UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/2 "2026-04-10T16:48:23Z")
Thanks — I’m on the MetaMask / Embedded Wallets (Web3Auth) team. I reviewed your report. Short summary & assessment - Likely an API-side validation regression: auth/verify is rejecting MPC/AA signatures \>500 chars when using account\_abstraction + id\_token. This matches your error: “signatures[0] length must be less than or equal to 500 characters long.” - I checked docs/KB and found no published change imposing a 500-char limit for AA/MPC signatures — this appears unexpected and needs escalation. What I already have to start escalation - SDK: MetaMask Embedded Wallets (Web3Auth) - Packages/versions: @web3auth/modal 10.15.0, @web3auth/auth 10.8.0, @web3auth/ws-embed 5.6.0 - Platform: Web (Vite), Sapphire mainnet - Repro: minimal SPA → POST [https://api-wallet.web3auth.io/auth/verify](https://api-wallet.web3auth.io/auth/verify) → 400 validation error for signatures[\*] \> 500 chars - Exact API error: { “message”: “"signatures[0]" length must be less than or equal to 500 characters long” } What I need from you (please attach to your Builder Hub topic) - The failing auth/verify request body (JSON). Redact private keys/JWTs, but keep id\_token, account\_type, and either an example signature string OR its length + encoding (base64/hex). - Full HTTP response body + status and any response headers; include request-id / x-request-id if present. - HAR or curl of the failing POST, and a timestamp (UTC) when you saw it. - Confirm whether disabling account\_abstraction (if you can test) allows the flow to succeed. Immediate guidance - If you can safely test with account\_abstraction disabled or a non-AA social login, that will confirm if this is AA-specific. If you can’t change production, don’t alter settings — just share the request/response above. - There’s no safe client-side workaround to recommend right now; this appears to be an API validation rule. Next steps from our side - I’m escalating this to the Embedded Wallets backend team now with the details you provided. A human engineer will follow up on the Builder Hub thread after they review the request/response you attach. Thanks — attach the auth/verify payload + response and I’ll push this directly to the backend team for priority review. > Note: This response was generated by an AI bot and may require further verification. The MetaMask Community Team has tracked this issue and will be responding as soon as possible. > Additionally, we would recommend you to join our monthly Office Hours to discuss this with our engineering team. [MetaMask Developer Office Hours](https://builder.metamask.io/t/metamask-developer-office-hours/2544/1) ---
**Author:** ![Aussie](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/aussie/32/3016_2.png) [@Aussie](https://builder.metamask.io/u/Aussie)\ **Post date:** [April 11, 2026, 2:31am UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/3 "2026-04-11T02:31:53Z")
### **1. Failing `POST …/auth/verify` request body (JSON, redacted)** **URL:** `https://api-wallet.web3auth.io/auth/verify` **Method:** `POST` **Content-Type:** `application/json` { “public\_address”: “0x4470…2A3510”, “id\_token”: “\”, “verifier”: “web3auth-google-sapphire”, “verifier\_id”: “s\*\*\*@hotmail.com”, “account\_type”: “account\_abstraction”, “chain\_namespace”: “eip155”, “email”: “s\*\*\*@hotmail.com”, “signatures”: [ “\”, “\”, “\” ], “network”: “mainnet”, “eoa\_address”: “0x3BD1…f8C7A1e”, “aa\_provider”: “safe”, “chain\_id”: “0x89” } **Encoding note:** Each `signatures[i]` value is a **stringified JSON object**. The inner `data` field is base64; `sig` is hex. Each **whole** `signatures[i]` string is **\> 500** characters, which triggers validation. * * * ### **2. Full HTTP response (status, body, headers)** **Status:** `400 Bad Request` **Response body:** { “statusCode”: 400, “error”: “Bad Request”, “message”: “Validation failed”, “validation”: { “body”: { “source”: “body”, “keys”: [“signatures.0”], “message”: “\“signatures[0]\” length must be less than or equal to 500 characters long” } } } **Response headers (as captured):** HTTP/1.1 400 Bad Request Date: Sat, 11 Apr 2026 01:43:29 GMT Content-Type: application/json; charset=utf-8 Content-Length: 221 Connection: keep-alive Access-Control-Allow-Origin: [https://wallet.web3auth.io](https://wallet.web3auth.io) Vary: Origin, Accept-Encoding Access-Control-Allow-Credentials: true Content-Security-Policy: default-src ‘self’;base-uri ‘self’;font-src ‘self’ https: data:;form-action ‘self’;frame-ancestors ‘self’;img-src ‘self’ data:;object-src ‘none’;script-src ‘self’;script-src-attr ‘none’;style-src ‘self’ https: ‘unsafe-inline’;upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 RateLimit-Policy: 10;w=60 RateLimit-Limit: 10 RateLimit-Remaining: 9 RateLimit-Reset: 60 ETag: W/“dd-0EOTbHPa7UKks/AMgpmf20pwQOo” * * * ### **3. Timestamp + redacted curl** **Incident time (UTC):** `2026-04-11 01:43:29 UTC` (from `Date` response header) curl ‘[https://api-wallet.web3auth.io/auth/verify](https://api-wallet.web3auth.io/auth/verify)’ \ -H ‘Accept: \*/\*’ \ -H ‘Content-Type: application/json; charset=utf-8’ \ -H ‘Origin: [https://wallet.web3auth.io](https://wallet.web3auth.io)’ \ -H ‘Referer: [https://wallet.web3auth.io/](https://wallet.web3auth.io/)’ \ -H ‘x-api-key: torus-default’ \ -H ‘baggage: ’ \ -H ‘sentry-trace: ’ \ --data-raw ‘{“public\_address”:“0x4470…2A3510”,“id\_token”:“\”,“verifier”:“web3auth-google-sapphire”,“verifier\_id”:“s\*\*\*@hotmail.com”,“account\_type”:“account\_abstraction”,“chain\_namespace”:“eip155”,“email”:“s\*\*\*@hotmail.com”,“signatures”:[“\”,“”,“”],“network”:“mainnet”,“eoa\_address”:“0x3BD1…f8C7A1e”,“aa\_provider”:“safe”,“chain\_id”:“0x89”}’ **Context:** `Origin` / `Referer` are `https://wallet.web3auth.io` — **hosted wallet** context, not our dapp origin. * * * ### **4. AA vs EOA (summary)** I did **not** change production. **Minimal test app** (HTML/Vite), fresh deps. - **AA / smart account on:** `POST …/auth/verify` → **400** , `signatures[0]` length limit — **cannot** complete login. - **AA off:** same embedded-wallet social login **succeeds** (EOA only); **no** `account_abstraction` failure. **No** `api-wallet…/auth/verify` in Network for the same flow (or not the failing payload). This looks **AA-specific** relative to the verify payload above. Thanks for escalating to the backend team. ---
**Author:** ![szilagyi84](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/szilagyi84/32/3017_2.png) [@szilagyi84](https://builder.metamask.io/u/szilagyi84)\ **Post date:** [April 13, 2026, 6:50am UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/4 "2026-04-13T06:50:12Z")
@system any update on this issue? It is breaking systems in production for 3 days now ---
**Author:** ![holyyy](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/holyyy/32/1556_2.png) [@holyyy](https://builder.metamask.io/u/holyyy)\ **Post date:** [April 13, 2026, 7:44am UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/5 "2026-04-13T07:44:16Z")
Hi @Aussie ! We have passed your case to our team and we will reply you as soon as we can. ---
**Author:** ![holyyy](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/holyyy/32/1556_2.png) [@holyyy](https://builder.metamask.io/u/holyyy)\ **Post date:** [April 16, 2026, 6:38am UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/6 "2026-04-16T06:38:52Z")
Hi @Aussie again. Thanks so much for your patience! This signatures error should have been fixed. Would you please try again? ---
**Author:** ![Aussie](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/aussie/32/3016_2.png) [@Aussie](https://builder.metamask.io/u/Aussie)\ **Post date:** [April 16, 2026, 10:37am UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/7 "2026-04-16T10:37:55Z")
Thank you, yes the issue seems to be resolved. ---
**Author:** ![Shubham\_Raikwar1](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/shubham_raikwar1/32/1734_2.png) [@Shubham\_Raikwar1](https://builder.metamask.io/u/Shubham_Raikwar1)\ **Post date:** [June 4, 2026, 9:26am UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/8 "2026-06-04T09:26:04Z")
same issue with my side ---
**Author:** ![holyyy](https://yyz1.discourse-cdn.com/flex011/user_avatar/builder.metamask.io/holyyy/32/1556_2.png) [@holyyy](https://builder.metamask.io/u/holyyy)\ **Post date:** [June 4, 2026, 9:39am UTC](https://builder.metamask.io/t/auth-verify-fails-signatures-0-must-be-500-characters-account-abstraction/3072/9 "2026-06-04T09:39:22Z")
@Shubham_Raikwar1 Please open a new post for your issue. Thank you!