# FIP: Farcaster "Quick Auth" server protocol discussion #231

Source: https://github.com/farcasterxyz/protocol/discussions/231
Kiwi News: https://news.kiwistand.com/stories/FIP-Farcaster-Quick-Auth-server-protocol-discussion-231?index=0x6833d9377b9f4c7ff462943bdbcd5a59766d0801ec723ce2e9bef480a267fca5cf0b354a
Submitted by tim on 2025-05-26 UTC, 1 upvote, 0 comments

## Summary

This FIP proposes a "Quick Auth" server that verifies Sign In with Farcaster (SIWF) credentials and issues signed JWTs, so developers avoid handling nonces, RPC state checks and session logic themselves. The article says integrating SIWF is significantly harder than integrating providers like Sign In with Google, which return a JWT that can be validated against the provider's server. The proposed open-source service would expose four endpoints: POST /nonce, POST /verify-siwf, GET /verify-jwt, and GET /.well-known/jwks.json for local verification. Tokens would carry the user's FID, the valid domain, the issuer and an expiration time, and the service could be hosted publicly at auth.farcaster.xyz or self-hosted. Its use would be optional.

## Article

Title: Farcaster "Quick Auth" Server Authors: @deodad

Abstract

Introduce a trusted server that verifies SIWF credentials and issues signed tokens to make integrating SIWF significantly easier.

Problem

Integrating Sign In with Farcaster into an application is significantly more difficult than existing integrating other social sign in providers like Sign In with Google. SIWF defines how to generate and resolve a signed credential to an identifier but developers still need to:

securely generate, store, and consume nonces

verify the SIWF credential, which requires making RPC requests to the get the latest state of Snapchain or Optimism and running up to date verification logic (for example, developers using auth-kit to verify credentials will need to manually upgrade to support auth addresses)

a mechanism for authenticated sessions

The developer will also want this to be performant. Compare this to something like Sign In with Google that does the heavy lifting for you and returns a JWT you can validate against their server.

Specification

Implement an OSS service that verifies SIWF credentials and issues signed JWTs suitable for short-lived sessions. This service would available at a public host like auth.farcaster.xyz and also easily deployable for developers that would prefer to self host.

It would have 4 endpoints:

POST /nonce to fetch a nonce

POST /verify-siwf to verify a SIWF message and get a JWT

GET /verify-jwt to verify a JWT (one off)

GET /.well-known/jwks.json to fetch public key that signs JWTs to so verification can be done locally (optimized JWT verification for use on a server)

The JWT would include the user's FID, the domain the JWT is valid on, the issuer of the JWT, and an expiration time. Applications can verify this token with a single API call to the authorization server or verify it locally using [JWKS(https://datatracker.ietf.org/doc/html/rfc7517).

It's important to note that using this service is completely optional.

Integration with Mini Apps

The Mini App SDK signIn action can be extended such that applications can request a session token directly instead of the raw SIWF credential. The Farcaster client the mini app is running in would complete the SIWF flow with the authorization server and return a JWT to the Mini App that Mini App can use directly as a session token. By default the public server would be used to handle SIWF and issue a token but this could be overridden for developers choosing to self-host.