curl --request POST \
--url https://api-stage.bitrobot.ai/subnets/{subnet_id}/connect/confirm \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
"nonce": "Qm3xk7w2Zr9vL1nB8pT4yH6sD0aF5cG2jK8mN1oP3qR",
"wallet_address": "HN7cABqLq46Es1jh92dQQisAq662SmxELLLsHHe4YWrH",
"subnet_user_id": "user_8f2c1"
}
'{
"status": "success",
"return_url": "https://app.bitrobot.ai/connect/callback?request_id=01ARZ3NDEKTSV4RRFFQ69G5FAV#ac=8Kd2mQx7f3RcVn0Pz_s1TgW6bHuJ4eLpAo9iNr-k5Zw",
"auth_code": "8Kd2mQx7f3RcVn0Pz_s1TgW6bHuJ4eLpAo9iNr-k5Zw",
"expires_at": "2026-09-02T10:30:00Z"
}Confirm a wallet connection
Confirms the wallet the signed-in user has on your subnet for a BitRobot Connect request.
Call this from your backend when the user presses Connect on your connect page. Send the request_id and nonce you stored when the user landed on the page, and the user’s wallet address.
Redirect the browser to the return_url in the response verbatim, fragment included. Branch on auth_code, not the HTTP status: a 409 already_confirmed response can also carry auth_code. Never log, display, or store auth_code.
If you send an Idempotency-Key header, use a new value on every attempt, including retries. Limit: 120 requests per minute per API key.
curl --request POST \
--url https://api-stage.bitrobot.ai/subnets/{subnet_id}/connect/confirm \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"request_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
"nonce": "Qm3xk7w2Zr9vL1nB8pT4yH6sD0aF5cG2jK8mN1oP3qR",
"wallet_address": "HN7cABqLq46Es1jh92dQQisAq662SmxELLLsHHe4YWrH",
"subnet_user_id": "user_8f2c1"
}
'{
"status": "success",
"return_url": "https://app.bitrobot.ai/connect/callback?request_id=01ARZ3NDEKTSV4RRFFQ69G5FAV#ac=8Kd2mQx7f3RcVn0Pz_s1TgW6bHuJ4eLpAo9iNr-k5Zw",
"auth_code": "8Kd2mQx7f3RcVn0Pz_s1TgW6bHuJ4eLpAo9iNr-k5Zw",
"expires_at": "2026-09-02T10:30:00Z"
}Authorizations
API key authentication. Your API key should start with brb_.
Example: Authorization: Bearer brb_1234567890abcdef
Path Parameters
The unique identifier of the subnet (ULID format). Must match the subnet your API key was created for.
^[0-9A-HJKMNP-TV-Z]{26}$Body
The request_id from your connect URL's query string, read from your server-side session.
^[0-9A-HJKMNP-TV-Z]{26}$"01ARZ3NDEKTSV4RRFFQ69G5FAV"
The nonce from your connect URL's query string, read from your server-side session.
"Qm3xk7w2Zr9vL1nB8pT4yH6sD0aF5cG2jK8mN1oP3qR"
The user's Solana wallet address on your subnet (base58, decodes to 32 bytes).
"HN7cABqLq46Es1jh92dQQisAq662SmxELLLsHHe4YWrH"
Optional. Your own identifier for the user. Truncated to 128 characters. Do not include personal data.
"user_8f2c1"
Optional. An Ed25519 signature by the user's wallet key over the UTF-8 string bitrobot-connect:<request_id>:<nonce>, base58-encoded. When present, this connection replaces an unproven connection another account holds for the same address on your subnet.
128"4vJ9JU1bJJE96FbKCbHmJmL8nT2rZ7yQpF1sWx3dGk8mQ2hVnA5cRt7uYbXe1PqLzMw9NfKd3SgHj6TrBv2CaEyU"
Response
Wallet recorded on the request. Redirect the browser to return_url verbatim, fragment included.
success Redirect the user's browser here verbatim, fragment included. Check that the scheme is http or https first.
"https://app.bitrobot.ai/connect/callback?request_id=01ARZ3NDEKTSV4RRFFQ69G5FAV#ac=8Kd2mQx7f3RcVn0Pz_s1TgW6bHuJ4eLpAo9iNr-k5Zw"
The authorization code, also present in return_url's fragment. Check for its presence. Never log, display, or store it. Single-use; expires 5 minutes after it is issued.
"8Kd2mQx7f3RcVn0Pz_s1TgW6bHuJ4eLpAo9iNr-k5Zw"
When the connect request expires: 30 minutes after the user pressed Connect next to your subnet on their BitRobot profile page.
"2026-09-02T10:30:00Z"