# Sign In to the Card Program

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

Send the signed sign-in message. Aurea opens and keeps the user's card program session.

## Overview

- `message` is the sign-in message exactly as [Sign-In Message](https://docs.aureahub.com/docs/cards-auth-message.md) answered it; `signature` is its `personal_sign` (EIP-191) by that address; `address` is the address.
- **The address in the message must be in lower case.** A checksummed address is not found by the card program: the answer is then a session for an account not yet registered (`isExistingGnosisUser` `false`), even for a registered user.
- Aurea stores the session the card program answers, encrypted, until its expiry or for 24 hours. A user's onboarding `status` is kept.
- The answer is the card program's, with `isExistingGnosisUser`: `true` when the wallet already has an account there — the session is ready, and `userData` holds the account as [Get the Account](https://docs.aureahub.com/docs/cards-user.md) answers it; `false` — call [Sign Up](https://docs.aureahub.com/docs/cards-auth-signup.md) next.
- A signature the card program refuses answers its status: `400`, or `403` `CARD_PROGRAM_SESSION_EXPIRED`.
- **Illustrative example.** The card program's answer is passed through unchanged and may carry fields not listed here: the example shows only the fields Aurea or its own app reads. Ignore the fields you do not know.

## Endpoint

### `POST /v1/gnosis/auth/challenge`

Authentication: bearer token required.

Opens the user's card program session with a signed sign-in message.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `message` | string | yes | The Sign-In with Ethereum message that was signed |
| `signature` | string | yes | Its `personal_sign` signature, `0x` hex |
| `address` | string | yes | The signing address |

**Responses**

`200` Existing Account (illustrative)

```json
{
  "token": "eyJhbGciOi…",
  "isExistingGnosisUser": true,
  "userData": {
    "kycStatus": "approved",
    "isSourceOfFundsAnswered": true,
    "isPhoneValidated": true,
    "safeWallets": [{ "address": "0x7a1c…e3b2" }]
  }
}
```

`200` New Account (illustrative)

```json
{
  "token": "eyJhbGciOi…",
  "isExistingGnosisUser": false
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/gnosis/auth/challenge \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"message": "aureahub.com wants you to sign in with your Ethereum account:\n0x2f4b6c2e9a1d5f3b7c8e0a4d6b2c9e1f3a5d7b90\n…", "signature": "0x…", "address": "0x2f4b6c2e9a1d5f3b7c8e0a4d6b2c9e1f3a5d7b90"}'
```

---

Web version: https://docs.aureahub.com/#cards-auth-challenge