TON Proof Authentication
Generate a signed TonConnect proof-of-ownership payload for a domain and challenge string. This proves control of the active wallet without sending a transaction.
MCP Tools
| Tool | Required | Optional |
|---|---|---|
generate_ton_proof | domain, payload | walletSelector |
get_wallet | — | walletSelector |
Workflow
- Get the exact
domainandpayloadfrom the user or the verifying service - Do not edit, normalize, decode, or invent the payload; it is part of the signed proof
- Ask one short yes/no confirmation before sending; If there are tools for dialogs/confirmation available, use them instead of a free-text prompt.
- Call
generate_ton_proofwith the domain and payload - Return the proof JSON to the user, or submit it to the service only when the user explicitly asked for that integration step
Output
The proof includes:
address: active wallet address in raw formatchain: TON Connect chain id (-239for mainnet,-3for testnet)walletStateInit: wallet state init in base64publicKey: wallet public keytimestamp: Unix timestamp used in the proofdomainLengthBytesanddomainValue: signed domain metadatasignature: base64 TonProof signaturepayload: original challenge payload
Notes
- TonProof is for authentication and proof of wallet ownership; it does not transfer funds
- TonProof still requires signing access. Imported read-only agentic wallets need operator key rotation completed before this tool can generate a proof
- Only generate a proof for domains and payloads the user intentionally provided or that came directly from the verifying service
- If multiple wallets are configured, pass
walletSelectorinstead of changing the active wallet for a one-off proof - If no wallet is configured, use the
ton-create-walletskill first