Developer Docs

Express API v1 will be retired on July 31, 2026. After that date, /v1/ endpoints will stop working. Wallets that have not been migrated to v2 by that date will be permanently inaccessible. See the migration guide.

Wallet Management

Get or Create Wallet

Get or create a wallet for the authenticated user and return its public address. If a wallet doesn’t exist for the user, one is created automatically and cryptographically bound to the user’s JWT identity.

cURL

curl -X POST 'https://tee.express.magiclabs.com/v2/wallet' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN' \
  -H 'X-Magic-API-Key: YOUR_MAGIC_API_KEY' \
  -H 'X-OIDC-Provider-ID: YOUR_OIDC_PROVIDER_ID' \
  -H 'X-Magic-Chain: ETH' 

Response:

{
  "public_address": "0x1234567890abcdef1234567890abcdef12345678"
}

Request Parameters

string

required

Header

The blockchain to create the wallet for. Available values: ETH, SOL, BTC

Response Fields

string

The wallet’s public address on the specified blockchain.

Each user can have one wallet per blockchain. Calling this endpoint multiple times with the same user and chain will return the same wallet address.

Signing Operations

All signing operations use the Authorization: Bearer JWT as the operation JWT (op_jwt). The Nitro Enclave verifies this JWT offline against JWKS baked into the enclave image and confirms the caller’s identity matches the wallet’s owner before authorizing the operation.

Sign Data

Sign a hash with the wallet’s private key. Send the hash together with transaction_data, the content it was computed from. Magic recomputes the hash from that content and signs only when they match.

cURL

curl -X POST 'https://tee.express.magiclabs.com/v2/wallet/sign/data' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN' \
  -H 'X-Magic-API-Key: YOUR_MAGIC_API_KEY' \
  -H 'X-OIDC-Provider-ID: YOUR_OIDC_PROVIDER_ID' \
  -H 'X-Magic-Chain: ETH' \
  -d '{
    "raw_data_hash": "0x50b2c43fd39106bafbba0da34fc430e1f91e3c96ea2acee2bc34119f92b37750",
    "transaction_data": {
      "method": "eth_sign",
      "data": "0x68656c6c6f"
    }
  }'

Response:

{
  "message_hash": "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
  "signature": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
  "r": "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
  "s": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef12345678",
  "v": "27"
}

Request Parameters

string

required

Header

The blockchain to sign for. Only ETH is supported: other chains have no transaction_data to check the hash against, so their requests are rejected. For Solana, use Sign Message with the serialized transaction message.

string

required

Body

The hash to sign (hex string with 0x prefix), computed from transaction_data as described below.

object

required

Body

What you’re signing. Required for ETH. Set method and the fields for it:

`method`	Fields	`raw_data_hash`
`eth_signTransaction`, `eth_sendTransaction`	`to`, `value`, `data`, `chainId`, `nonce`, `gasLimit`, and `maxFeePerGas` + `maxPriorityFeePerGas` (EIP-1559) or `gasPrice` (legacy)	The unsigned transaction hash
`eth_signTypedData_v4`, `eth_signTypedData_v3`	`typedData`: the full EIP-712 JSON (`types`, `primaryType`, `domain`, `message`)	The EIP-712 hash
`eth_signTypedData`	`typedData`: the v1 typed data array	eth-sig-util `typedSignatureHash`
`eth_sign`	`data`: the message, as `0x`-prefixed hex bytes or plain text	The EIP-191 hash
`eth_sign7702Authorization`	`chainId`, `address` (the delegate contract), `nonce`	keccak256(0x05 ‖ rlp([chainId, address, nonce]))

See EVM data preparation for code that builds each one. Transactions with an access list, blobs or an authorization list are not supported here.

raw_data_hash without matching transaction_data is rejected with 400 INVALID_SIGNING_PARAMS. To sign a plain message without hashing it yourself, use Sign Message; for an EIP-7702 authorization, use Sign EIP-7702 Authorization.

Response Fields

string

The hash that was signed.

string

The complete signature in hex format.

string

The r component of the ECDSA signature.

string

The s component of the ECDSA signature.

string

The recovery parameter of the ECDSA signature.

Sign EIP-7702 Authorization

Sign an EIP-7702 authorization that delegates an EOA to a smart contract implementation. This is used to temporarily upgrade an EOA into a smart wallet for a transaction bundle, enabling features like batched calls and gas sponsorship.

cURL

curl -X POST 'https://tee.express.magiclabs.com/v2/wallet/sign/eip7702' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN' \
  -H 'X-Magic-API-Key: YOUR_MAGIC_API_KEY' \
  -H 'X-OIDC-Provider-ID: YOUR_OIDC_PROVIDER_ID' \
  -H 'X-Magic-Chain: ETH' \
  -d '{
    "chain_id": 84532,
    "address": "0x1234567890abcdef1234567890abcdef12345678",
    "nonce": 0
  }'

Response:

{
  "r": "12345678901234567890123456789012345678901234567890123456789012345678",
  "s": "98765432109876543210987654321098765432109876543210987654321098765432",
  "y_parity": 0
}

Request Parameters

string

required

Header

The blockchain to sign for. Available values: ETH, SOL, BTC

number

required

Body

The chain ID for the authorization (e.g., 84532 for Base Sepolia).

string

required

Body

The smart contract address to delegate to (20-byte hex string).

number

required

Body

The authorization nonce.

Response Fields

string

The r component of the ECDSA signature (decimal string).

string

The s component of the ECDSA signature (decimal string).

number

The y-parity bit (0 or 1) used for EIP-7702 signature recovery.

Sign Message

Sign an arbitrary message using the wallet’s private key. Useful for authentication, off-chain verification, and personal signatures.

cURL

curl -X POST 'https://tee.express.magiclabs.com/v2/wallet/sign/message' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_JWT_TOKEN' \
  -H 'X-Magic-API-Key: YOUR_MAGIC_API_KEY' \
  -H 'X-OIDC-Provider-ID: YOUR_OIDC_PROVIDER_ID' \
  -H 'X-Magic-Chain: ETH' \
  -d '{
    "message_base64": "SGVsbG8gV29ybGQ="
  }'

Response:

{
  "signature": "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12",
  "r": "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
  "s": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef12345678",
  "v": "27"
}

Request Parameters

string

required

Header

The blockchain to sign for. Available values: ETH, SOL, BTC

string

required

Body

The message to sign, encoded as base64.

Response Fields

string

The complete signature in hex format.

string

The r component of the ECDSA signature.

string

The s component of the ECDSA signature.

string

The recovery parameter of the ECDSA signature.

Server Wallets

Express API

Core API

Wallet Operations

Wallet Management

Get or Create Wallet

Request Parameters

Response Fields

Signing Operations

Sign Data

Request Parameters

Response Fields

Sign EIP-7702 Authorization

Request Parameters

Response Fields

Sign Message

Request Parameters

Response Fields

​Wallet Management

​Get or Create Wallet

​Request Parameters

​Response Fields

​Signing Operations

​Sign Data

​Request Parameters

​Response Fields

​Sign EIP-7702 Authorization

​Request Parameters

​Response Fields

​Sign Message

​Request Parameters

​Response Fields

Wallet Management

Get or Create Wallet

Request Parameters

Response Fields

Signing Operations

Sign Data

Request Parameters

Response Fields

Sign EIP-7702 Authorization

Request Parameters

Response Fields

Sign Message

Request Parameters

Response Fields