Sign in & identity
Sign-in lives at https://auth.mithril.fund/sign-in (service kotoba-authn, WebAuthn rpId auth.mithril.fund, apex mithril.fund). Methods: passkeys (Face ID / Touch ID); Base Account (passkey-owned smart account + SIWE on Base chainId 8453); Ethereum SIWE (EIP-4361); DID/CACAO (kotoba cacao --aud https://auth.mithril.fund, one-shot); a recovery phrase (client-derived, not stored server-side); and TOTP 2FA with recovery codes. Passwords, email, SMS and OAuth are not ways to sign in. Linking Google / GitHub names the account; one of the methods above proves it.
rpId and the former host
Passkeys are bound to rpId auth.mithril.fund. Passkeys registered on auth.kotobase.net do not migrate automatically to auth.mithril.fund — re-register under the new rpId.
The session cookie is intended for the mithril.fund registrable domain (shared with the console/api product shell). Do not document a host-only auth cookie unless engineering confirms a change.
The principal
Signing in yields a stable identifier (the principal, did:web:kotoba.cloud:tenant:…). It survives passkey and wallet changes; verification, scopes, balances and jobs are all bound to it.
Verification and the assurance ladder
Red-team models run only behind verification. Each rung names its evidence and a daily token allowance (the same table /v1/secure serves).
| rung | Evidence | tokens/day | Band |
|---|---|---|---|
card · L1 |
a live credit/debit card (prepaid rejected) verified with a $0 check | 102400 (ceiling 102400) | code-review |
identity · L2 |
Stripe Identity document + selfie check bound to the principal | 50000 (ceiling 200000) | code-review |
business · L3 |
a company on a public registry, a proven domain claim, clean screening | 2000000 (ceiling 8000000) | cyber |
contracted · L4 |
named researchers, a signed authorized-scope statement, a contract | 8000000 (ceiling 32000000) | offensive |
- Card verification: register a credit or debit card through Stripe Checkout (setup mode, no charge). Prepaid and virtual cards answer 403 prepaid-card-not-accepted. Approval arrives from Stripe's webhook within seconds; the code-review scope is approved with it.
- Document verification (Stripe Identity) can be added. The evidence itself stays at Stripe; mithril.fund keeps status, expiry and an evidence reference.
- Expiry: verification 365 days, AML/CTF screening 24 hours, the trust route as a 60-second projection re-stamped on every read.
Connection tokens (PAT)
- Issued in the account console, shown once. Acts as the principal on the research API and the balance read; cannot buy or manage organizations.
- Revocable one by one (the console's list → revoke). A revoked token answers 401 token-revoked. Older (v1) tokens are invalidated together by “revoke legacy tokens” and answer the same 401 afterwards.
401 {"error": {"code": "token-revoked", "message": "personal API token refused: legacy-token-revoked — issue a new one at https://admin.mithril.fund/account"}}Auth API (machine)
Routes for accurate documentation — do not paste secrets. Host: https://auth.mithril.fund.
-
POST /v1/passkey/{login,register}/{options,verify} -
POST /v1/passkey/smart-account/{options,verify} -
POST /v1/siwe/{nonce,options,verify} -
POST /v1/cacao/session -
POST /v1/totp/verify -
GET /v1/session -
GET /v1/link/hint
The auth host has no /.well-known/kotoba-cloud.json or /ready yet (404). Do not claim them until shipped.
Recovery (every registered sign-in method lost) carries a server-enforced delay of at least 48 hours and an offline one-time secret. No operator can open a sign-in on your behalf.