Phantom (Solana) Authentication Development

Development of Phantom (Solana) Authorization

Phantom — most popular Solana wallet (10M+ installs). Authorization via Phantom follows same concept as SIWE for Ethereum — message signing to prove address ownership, but with Solana-specific features: Ed25519 signatures, base58 addresses, different message format.

Phantom Provider API

Phantom injects window.solana when extension is installed. Modern approach — use @solana/wallet-adapter-react for unified interface.

import { useWallet } from '@solana/wallet-adapter-react';
import { WalletMultiButton } from '@solana/wallet-adapter-react-ui';

function SolanaAuth() {
    const { publicKey, signMessage, connected } = useWallet();
    
    const handleSignIn = async () => {
        if (!publicKey || !signMessage) return;
        
        // Get nonce from backend
        const { nonce } = await fetch('/api/solana-nonce').then(r => r.json());
        
        // Form message
        const message = `Sign this message to authenticate with our app.\n\nNonce: ${nonce}`;
        const messageBytes = new TextEncoder().encode(message);
        
        // Sign (opens Phantom popup)
        const signature = await signMessage(messageBytes);
        
        // Send to backend
        await fetch('/api/solana-verify', {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({
                publicKey: publicKey.toBase58(),
                signature: Buffer.from(signature).toString('base64'),
                message
            })
        });
    };
    
    return (
        <>
            <WalletMultiButton /> {/* Ready button with Phantom */}
            {connected && <button onClick={handleSignIn}>Sign In</button>}
        </>
    );
}

Backend Ed25519 Verification

Solana uses Ed25519 (not ECDSA like Ethereum). Verification:

import { PublicKey } from '@solana/web3.js';
import nacl from 'tweetnacl';
import bs58 from 'bs58';

async function verifySolanaSignature(
    publicKeyBase58: string,
    message: string,
    signatureBase64: string
): Promise<boolean> {
    try {
        const publicKey = new PublicKey(publicKeyBase58);
        const messageBytes = new TextEncoder().encode(message);
        const signatureBytes = Buffer.from(signatureBase64, 'base64');
        
        // Ed25519 verification via nacl
        return nacl.sign.detached.verify(
            messageBytes,
            signatureBytes,
            publicKey.toBytes()
        );
    } catch {
        return false;
    }
}

Wallet Adapter: Multi-Wallet Support

import { PhantomWalletAdapter, SolflareWalletAdapter } from '@solana/wallet-adapter-wallets';

const wallets = [
    new PhantomWalletAdapter(),
    new SolflareWalletAdapter(),
    // BackpackWalletAdapter, etc.
];

// Provider supports all wallets
<WalletProvider wallets={wallets} autoConnect>
    <YourApp />
</WalletProvider>

Phantom auth — 1-2 days for backend + frontend integration. Single interface via wallet-adapter allows supporting multiple Solana wallets with one code.