Security

Trust is the product.

AEGIX is built so that authentication never touches your funds and your intelligence stays attributable only to your wallet.

Wallet-only authentication

AEGIX authenticates by asking you to sign a challenge with your Solana wallet. There is no email/password login and no third-party identity provider.

Signing the authentication challenge costs no SOL and does not create a blockchain transaction. Your private keys never leave your wallet.

AEGIX never requests your private keys or seed phrase. Only your public address and a signed message are ever sent to the server.

Authentication challenges are bound to the AEGIX domain and carry a nonce and expiry, which prevents replay of a captured signature.

A session token is stored locally and verified server-side on every request. Wallet account switching invalidates the prior session.

Developer API keys are shown once at creation, stored only as a one-way hash, and scoped to specific permissions. They must never be sent in URLs.

Webhook deliveries are signed with an HMAC-SHA256 signature using a per-endpoint secret, so consumers can verify authenticity and detect tampering.

Practical guidance

• Treat signatures like passwords — never share a signed authentication message.
• Store developer API keys in a secrets manager, never in client code or URLs.
• Verify every webhook signature before acting on a delivery.
• Webhook endpoints must not accept arbitrary redirects; AEGIX blocks private/internal network targets.

The notification email is a delivery destination only — it is never a login credential.