{
  "id": 16782472,
  "title": "Sign-In with Ethereum in Next.js 16: SIWE with viem, iron-session and a Replay-Proof Nonce (Tested)",
  "url": "https://urgent.news/2026/10/27/sign-in-with-ethereum-in-next-js-16-siwe-with-viem-iron-session-and-a",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-10-27T19:09:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/fabwaseem/sign-in-with-ethereum-in-nextjs-16-siwe-with-viem-iron-session-and-a-replay-proof-nonce-tested-3lf4"
  },
  "original_language": "en",
  "account": "The article discusses implementing Sign-In with Ethereum (SIWE) in a Next.js 16.4.3 application using viem 2.57.11 and iron-session 9.0.1. The process involves issuing a nonce, signing a message with the user's wallet, and verifying the signed message on the server. viem provides the necessary helpers, so no additional packages are required. The article highlights two key findings during testing: the nonce should be stored server-side and deleted upon first use to prevent replay attacks, and using viem's default verification mode can result in significantly slower verification times when the RPC endpoint is down. The recommended approach is to issue a nonce, build the EIP-4361 message, sign it with the user's wallet, and verify it on the server using viem's SIWE helpers while passing the expected domain and nonce.",
  "summary": "Cross-posted from my blog. The original, with any updates, lives on fabwaseem.com . Sign-In with Ethereum (SIWE) lets a user log in by signing a plain-text message with their wallet, as defined in EIP-4361 . In Next.js you need three pieces: a route that issues a nonce, a route that verifies the signed message, and a session cookie. viem ships every SIWE helper you need, so no extra siwe package…",
  "key_points": [
    "Implement SIWE in Next.js 16.4.3 using viem 2.57.11 and iron-session 9.0.1",
    "Issue nonce, sign message with user's wallet, and verify server-side",
    "Store nonce server-side, delete upon first use to prevent replay attacks"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}