Sign Personal Message

The signPersonalMessage action prompts the connected wallet to sign a personal message. This is useful for authentication, proof of ownership, or other scenarios where you need cryptographic proof that a user controls a specific account.

Usage

import { createDAppKit } from '@mysten/dapp-kit-core';

const dAppKit = createDAppKit({
	/* config */
});

const message = new TextEncoder().encode('Please sign this message');
const result = await dAppKit.signPersonalMessage({
	message,
});

console.log('Message bytes:', result.bytes);
console.log('Signature:', result.signature);

Parameters

• message: Uint8Array - The message to sign as a byte array
• account (optional) - UiWalletAccount - The account to sign with. Defaults to the currently connected account. Must belong to the connected wallet, otherwise a WalletAccountNotFoundError is thrown. Lets you sign with a specific account without changing the selected account via switchAccount.
• network (optional) - The network to sign against (a configured network identifier such as 'mainnet'). Defaults to the active network. The signing chain is derived from it, so you can sign against a network without changing the active network via switchNetwork. Throws a ChainNotSupportedError if the signing account does not support the network. This matters for network-bound signatures such as zkLogin.

Return value

Returns a Promise that resolves to an object containing:

• bytes: string - Base64 encoded message bytes
• signature: string - Base64 encoded signature

Message format

The message parameter must be a Uint8Array. Common patterns for creating byte arrays:

const textMessage = new TextEncoder().encode('Hello, Sui!');
await dAppKit.signPersonalMessage({ message: textMessage });

const jsonMessage = new TextEncoder().encode(
	JSON.stringify({ action: 'sign', timestamp: Date.now() }),
);
await dAppKit.signPersonalMessage({ message: jsonMessage });

Security considerations

Message content

• Always display the message content clearly to users before signing
• Avoid signing opaque or encoded data that users cannot understand
• Include human-readable prefixes for different message types
• Consider adding timestamps to prevent replay attacks