Authentication

Authentication

Boon uses different auth models for different surfaces.

Recipient link vouchers

Recipients prove GitHub or X ownership through OAuth. The Worker signs an EIP-712 Link voucher that the contract verifies.

Voucher fields:

providerHash   bytes32
handleHash     bytes32
recipient      address
nonce          uint256
deadline       uint256

Domain:

name:              Boon
version:           1
chainId:           8453
verifyingContract: 0xfb6662AdaF0611a94322634d5B86203Cfb59d5e8

The Worker reads live linkNonce and linkedWallet before signing. The hosted claim flow refuses ordinary already-linked handles.

Sender disclosure signatures

Optional sender disclosure lets the sender of a known boon opt into public disclosure metadata on that receipt.

Endpoints:

POST /api/v1/boons/:txHash/disclosure
DELETE /api/v1/boons/:txHash/disclosure

Both require a signature over:

Disclosure(bytes32 txHash,string action)

Domain:

name:              Boon Disclosure
version:           1
chainId:           8453
verifyingContract: 0xfb6662AdaF0611a94322634d5B86203Cfb59d5e8

The Worker checks the recovered signer against the indexed tipper for the receipt. If the subgraph cannot verify the receipt, disclosure writes are refused.

x402 payment auth

Paid graph endpoints use x402 payment headers rather than app sessions or API keys. See x402 protocol.