> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ryft.market/llms.txt
> Use this file to discover all available pages before exploring further.

# Logging in

> No password, no email signup, no exchange API keys. You sign in by proving you control a Solana wallet.

<Steps>
  <Step title="Click Connect Wallet" />

  <Step title="Pick your wallet">
    Phantom, Solflare, or any Solana wallet that can sign a message.
  </Step>

  <Step title="Approve the message">
    Your wallet pops up a message to sign. Read it, then approve. That's it — you're in.
  </Step>
</Steps>

## You're signing a message, not a transaction

This is what makes the login safe. A **transaction** moves funds and costs gas. A **message
signature** does neither. Signing the login message:

* costs **nothing** — no gas, no fee,
* moves **no funds**,
* grants **no spending permission** to anyone,
* only proves that you hold the key for that address.

The message contains a one-time code (a "nonce") issued seconds earlier. It can be used once and
expires in ten minutes, so a captured signature can't be replayed later.

<Danger>
  **Check the domain.** The message names the site you're signing into. **Check that domain matches the
  site you're actually on.** That check is what protects you from a phishing clone asking for the same
  signature.
</Danger>

## What happens on your first sign-in

ryft provisions your **MPC custody wallet** — the wallet that holds your deposit and signs your
trades. Its private key is never assembled in one place; it's split so that no single party,
including ryft, ever has the whole key.

* **There's nothing for you to paste.** The architecture has no place to put an API key, which is why
  nobody at ryft can ever legitimately ask you for one.
* **The trading agent can't withdraw.** A compromised trading path can't drain you.

Your deposit address is derived from this wallet, so it's the same every time you sign in with the
same wallet.

## Your wallet address is your account

There's no separate user ID. The Solana address you sign in with **is** your account. Sign in with a
different address and you get a different account, with its own deposit address and its own funds.

<Note>
  **First thing to check.** If your balance looks empty, check which wallet address is connected.
  Switching accounts in Phantom switches accounts in ryft.
</Note>

## Staying signed in

Your session is a token held by the app. It doesn't last forever — when it expires you'll be asked to
sign a fresh message. That's routine. Signing out clears the session but doesn't touch your funds,
positions, or deposit address.

Because your account is a wallet, **anyone who can sign with that wallet can access your account.**
Protect it the way you'd protect any wallet holding funds.

## Troubleshooting

| Problem                    | What's happening                                     | Fix                                                           |
| -------------------------- | ---------------------------------------------------- | ------------------------------------------------------------- |
| Wallet doesn't open        | Extension asleep or popup blocked                    | Open the wallet extension manually, then retry                |
| "Invalid or expired nonce" | The login code expired (10 min) or was already used  | Just retry — a fresh code is issued each attempt              |
| "Domain mismatch"          | The site you're on isn't an allowed ryft domain      | **Stop.** Verify the URL — this is what a phishing site trips |
| Signed in, but no funds    | A different wallet address is connected              | Check the address in the header against the one you funded    |
| Asked to sign repeatedly   | Session expiring, or the browser is clearing storage | Check for privacy settings blocking site storage              |

<Danger>
  **Security.** ryft will **never** ask for your seed phrase or private key — not for support, not for
  recovery. ryft will **never** send you a signature request over DM or through a shared link. Only
  ever sign a ryft login message on a ryft domain you navigated to yourself.

  If a page asks you to approve a **transaction** when you expected to sign a login **message**, reject
  it and check where you are.
</Danger>