Sign-In with Ethereum in Next.js 16: SIWE with viem, iron-session and a Replay-Proof Nonce (Tested)
Cross-posted from my blog. The original, with any updates, lives on fabwaseem.com . Sign-In with Ethereum (SIWE) lets a user log in by signing a plain-text message with their wallet, as defined in EIP-4361 . In Next.js you need three pieces: a route that issues a nonce, a route that verifies the signed message, and a session cookie. viem ships every SIWE helper you need, so no extra siwe package…
The article discusses implementing Sign-In with Ethereum (SIWE) in a Next.js 16.4.3 application using viem 2.57.11 and iron-session 9.0.1. The process involves issuing a nonce, signing a message with the user's wallet, and verifying the signed message on the server. viem provides the necessary helpers, so no additional packages are required.
The article highlights two key findings during testing: the nonce should be stored server-side and deleted upon first use to prevent replay attacks, and using viem's default verification mode can result in significantly slower verification times when the RPC endpoint is down. The recommended approach is to issue a nonce, build the EIP-4361 message, sign it with the user's wallet, and verify it on the server using viem's SIWE helpers while passing the expected domain and nonce.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.