NFT access control
Sigma can check connected wallets for BSV 1Sat NFTs by origin or collection and return a count. Your application decides what that result permits. The implemented endpoint is available in the auth server; it is not a planned ERC-20 balance, staking, or cross-chain token-gating API.
Flow
- The user signs in to Sigma and connects a wallet to the intended BAP profile.
- Sigma stores the proven wallet connection and queries the ordinal indexer.
- Your application checks an origin/collection and a minimum NFT count.
- Your backend enforces access using its own trusted authentication and authorization policy.
The verification endpoint currently uses the account's primary profile. It does not accept a profile selector to check whichever profile an OAuth client selected. Do not silently treat those identities as the same.
Limits
Wallet APIs require the supported Sigma account session; an arbitrary OAuth access token is not a substitute. Browser cookie forwarding does not create an authenticated server-to-server integration. If your backend cannot use an explicitly supported authorization path, verify ownership through your own wallet proof/indexer integration rather than trusting a client-provided owns: true.
Indexer failures can produce incomplete negative results. The response is not a signed, portable attestation and ownership may change after checking. Choose a suitable recheck policy and fail closed when required evidence is unavailable.
Continue with NFT verification, thresholds, or the wallet API.