SessionKit — Login with BLAC

Three seconds to a session

No redirects, no OAuth dance, no account creation. The wallet the user already trusts is the authenticator.

01

Your site shows a BLAC Code

SessionKit generates a fresh key pair and renders the code — cryptographically bound to your domain.

02

The user scans and approves

BLAC Wallet verifies your domain, then shows the user exactly what you're requesting — nothing is shared until they approve.

03

You get a verified session

An end-to-end encrypted channel with a signed, per-domain user identity. The relay in between sees only ciphertext.

Quickstart

Three steps from zero to "Login with BLAC" on your site.

Step 1

Prove your domain

Generates your signing key pair and writes .well-known/blac-session.json for you to host. That file is what lets BLAC Wallet verify your codes really come from your domain. Your private key never leaves your server.

$ npx @blaclabs/sessionkit init

Step 2

Add the kit

Load it from our CDN pinned to a major version — security fixes reach your site the moment we ship them. Prefer bundling? The npm package carries full TypeScript types.

<script src="https://sessionkit.blaclabs.io/v1/sessionkit.js"></script>

$ npm install @blaclabs/sessionkit

Step 3

Connect

Request only the scopes you need. SessionKit renders the BLAC Code, handles the relay, and resolves when the user approves in the app.

const session = await BLACSession.connect({
  scopes: ["identity", "address:solana"]
});

console.log(session.user.id);      // stable ID, unique to your domain
console.log(session.user.solana);  // granted scopes only

Scopes

You ask, the user decides. Every scope is shown in plain language on the approval screen — and only what's granted is ever shared.

identity

A pairwise user ID unique to your domain, cryptographically verifiable.

profile:username

The user's chosen BLAC username.

profile:avatar

The user's profile picture.

address:solana

The user's Solana address — for NFTs, tokens, and on-chain checks.

favorites:read

The user's favorite markets, read-only.

trade:*

Never available to third parties. SessionKit sessions cannot place orders, sign transactions, or move funds. By design, forever.

Built like a wallet, because it is one

SessionKit is the same session layer that powers BLAC Terminal. Trust comes from cryptography and user consent — never from secrecy.

Domain proof

Every BLAC Code is signed by a key served from your domain over TLS. A scam site can connect as itself — but it can never impersonate you.

Consent, always visible

The approval screen names your verified domain and lists every requested scope in plain language. Your users always see exactly what you ask for.

Pairwise identity

Each domain gets its own user ID, derived per-site. Two websites can never correlate the same user — and nobody gets a financial address without asking.

End-to-end encrypted

P-256 key agreement, HKDF-derived session keys, AES-GCM on every message. The relay forwards ciphertext it cannot read.

BLACWALL watches

Known scam domains trigger a hard warning in the app before anything is shared. First-time domains are flagged as new. The user always keeps the final say.

Revocable in one tap

Users see every connected site in the app and can revoke any session instantly. A revoked session is dead — no grace period, no residual access.

Pin once,
stay current

sessionkit.blaclabs.io/v1/

The CDN URL is pinned to a major version. Within it, security fixes and improvements reach every site automatically — the moment we ship them.

Breaking changes only ever land in a new major. Old majors keep working, because BLAC Wallet speaks every protocol version we've shipped — your integration never breaks behind your back.

Login with BLAC