Sign in with a
signature.

// server.js — verify the wallet callback (Express)
app.post('/digiid/callback', express.json(), express.urlencoded({ extended: false }), (req, res) => {
  const { address, uri, signature } = req.body;
  if (!address || !uri || !signature) return res.status(400).json({ error: 'missing fields' });

  const digiid = new DigiID({ address, uri, signature, callback: CALLBACK });
  const challenge = pending.get(digiid.nonce);

  if (!digiid.uriValid() || !challenge || challenge.expires < Date.now()) {
    return res.status(410).json({ error: 'unknown or expired challenge' });
  }
  if (!digiid.signatureValid()) return res.status(401).json({ error: 'invalid signature' });

  pending.delete(digiid.nonce);            // single use: a replay now fails
  sessions.login(challenge.sessionId, address); // address = the user's ID for your site
  res.json({ message: 'Digi-ID verified' });
});

<?php
// callback.php — verify the wallet callback (digiid-php)
require_once __DIR__ . '/DigiID.php';
$digiid = new DigiID();

// Wallets send JSON; manual signing tools send form fields.
$input = json_decode(file_get_contents('php://input'), true) ?? $_POST;
$address   = (string) ($input['address'] ?? '');
$signature = (string) ($input['signature'] ?? '');
$uri       = (string) ($input['uri'] ?? '');

$nonce = $digiid->extractNonce($uri);
$row = $db->prepare('SELECT session_id FROM digiid_nonces WHERE nonce = ? AND expires_at > ? AND address IS NULL');
$row->execute([$nonce, time()]);
$challenge = $row->fetch();

$expectedUri = $digiid->buildURI('https://www.example.com/digiid/callback.php', $nonce);

if (!$challenge || $uri !== $expectedUri
    || !$digiid->isMessageSignatureValidSafe($address, $signature, $uri)) {
    http_response_code(401);
    exit(json_encode(['error' => 'invalid or expired Digi-ID challenge']));
}

// Consume the nonce and attach the verified address to the waiting session.
$db->prepare('UPDATE digiid_nonces SET address = ? WHERE nonce = ?')->execute([$address, $nonce]);
echo json_encode(['message' => 'Digi-ID verified']);

// login.js — show the challenge in the browser
import QRCode from 'qrcode';

const { uri, nonce } = await fetch('/digiid/challenge', { method: 'POST' }).then((r) => r.json());

// Tappable on mobile (opens the wallet), scannable on desktop.
document.querySelector('#digiid-link').href = uri;
await QRCode.toCanvas(document.querySelector('#digiid-qr'), uri, { width: 240 });

// Wait for the wallet to call back, then continue the session.
const poll = setInterval(async () => {
  const { state } = await fetch(`/digiid/status?nonce=${nonce}`).then((r) => r.json());
  if (state === 'verified') {
    clearInterval(poll);
    location.assign('/account');
  }
}, 2000);

# 1. The server needs the PHP GMP extension
php -m | grep -i gmp

# 2. Upload the plugin and activate it
git clone https://github.com/DigiByte-Core/digiid-wp-authentication \
  wp-content/plugins/digiid-wp-authentication
wp plugin activate digiid-wp-authentication

# 3. The login screen now shows a Digi-ID QR code.
#    Note: the plugin was last tested with WordPress 4.1.

POST /callback HTTP/1.1
Host: digiid.digibyteprojects.com
Content-Type: application/json

{
  "address": "DJDAkjie6nrW6RpFZSTpNUXsZ9JE2x6p1o",
  "uri": "digiid://digiid.digibyteprojects.com/callback?x=c6140375e5bae71e",
  "signature": "H3tlK3RciMR60PuE0jE6JuClqgh+E8MmMz+n+4+P7FAIVuUccs+npnIa6Gz8XAJeOilTWpLNbomXtVDe4gR0CNk="
}