Authentication

Bento uses two layers:

1. Builder API key identifies your app (apiKey → x-builder-api-key). Required by createBentoSdk. For hackathons, generate a testnet key.
2. User JWT identifies the user (below). Attach it with jwtAuthProvider / walletAuthProvider on createBentoSdk({ auth }).

Use baseUrl: 'https://internal-server.bento.fun' on testnet. You store the session. Bento does not keep platform logins for you.

EOA

Sign the login message, then call eoaLogin (or eoaRegister for a new wallet):

const ts = String(Date.now());
const signature = await account.signMessage({
  message: `Bento.fun Login\nTimestamp: ${ts}\nWallet: ${account.address}`,
});

const { token } = (await sdk.public.auth.eoaLogin({
  address: account.address,
  signature,
  timestamp: ts,
})) as { token: string };

The session also returns your managed account address (where balances live). On testnet, fund it next with the auto-mint faucet (POST /bento/auto-mint/mint); register/login alone leaves the balance at zero. → Money

Weblink

For apps that send the user through a browser connect page:

const { url } = await sdk.public.externalLink.getLinkUrl({
  returnUrl: 'https://your.app/callback',
  state: 'your-user-id',
});

// user opens `url`, signs in, returns to callback?code=…&state=…
// On testnet, `url` is hosted at https://testnet.bento.fun/connect?lt=…
// (mainnet: https://app.bento.fun/connect?lt=…).

const { token, state } = await sdk.public.externalLink.exchange({ code });

Tournaments host

sdk.tournaments.auth.login uses the same signed login message and returns a tournaments-host JWT.