> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.coinflow.cash/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.coinflow.cash/_mcp/server.

# Wallet-Signed Authentication (Advanced)

> **Warning**
>
> **This page is for advanced / cryptocurrency-native companies.** If that's not you, head back to the [Quickstart](/guides/getting-started/quickstart) for the standard flows.

## What Is Wallet-Signed Authentication

Advanced: this applies only to integrations where your customers authenticate with a Solana or EVM wallet. If your customers connect Coinflow with a Solana or EVM wallet, you can require them to sign a message with that wallet before viewing their saved cards and bank accounts. This prevents anyone who knows the wallet address from viewing linked payment methods.

## Implementation

Coinflow uses wallet message signing authentication to validate that a particular user owns the wallet associated with their account. In order to enable this in your integration you will need to implement the `signMessage` function in your wallet.

> 📘 Please upgrade to `@coinflowlabs/react` > v3 and `@coinflowlabs/react-native` > v2

### Solana

```javascript
<CoinflowPurchase
  ...
  wallet={{
    ...
    signMessage: (message: UInt8Array) => Promise<UInt8Array>;
  }}
 />
```

### EVM

```javascript
import { useSignMessage } from "wagmi";

const {signMessageAsync} = useSignMessage();

const signMessage = useCallback(
  async (message: string) => {
    // It is not necessary to use wagmi you can use any custom logic to generate a valid signature for the address
    return await signMessageAsync({ message });
  },
  [signMessageAsync]
);

<CoinflowPurchase
  ...
  wallet={{
    ...
    signMessage,
  }}
 />
```

### Enable Strong Authentication on Merchant Settings

Once you have message signing integrated for your application you can head to [your settings page ](https://merchant.coinflow.cash/settings) and enable strong authentication for your account.

> 🚧 Enabling this without implementing `signMessage` from above will break all withdraws and not allow checkout customers to view their saved cards.