moonpay-auth

name	moonpay-auth
description	Set up the MoonPay CLI, authenticate, and manage local wallets. Use when commands fail, for login, or to create/import wallets.
tags	["setup"]

MoonPay auth and setup

Install

npm i -g @moonpay/cli

This installs the mp (and moonpay) binary globally.

Verify installation

mp --version
mp --help

Auth commands

# Log in — returns a URL. Open it yourself if you can, otherwise share it with the user verbatim; opening it triggers the OTP code email.
mp login --email [e-mail]

# Verify OTP code (user pastes it back from their email)
mp verify --email [e-mail] --code 123456

# Check current user
mp user retrieve

# Log out
mp logout

mp login returns a URL. If you can open it yourself (e.g., browser access or a programmatic fetch), do that — it triggers the OTP email send. Otherwise, post the URL back to the user verbatim (don't paraphrase or strip query parameters) and let them open it. Either way the OTP lands in the user's email; they paste the code back, and you run mp verify.

Before logging in (REQUIRED)

Never call mp login blindly. Every login attempt must be preceded by a session check:

1. Run mp user retrieve first.

2. If it succeeds, a session already exists. Tell the user which account is signed in and ask whether to switch:

   "You're currently signed in as <email>. Log out and sign in as a different user? Reply YES to switch."

   Only on an explicit affirmative, run mp logout and then proceed with mp login. If the user declines or says anything ambiguous, treat the existing session as the one to use and skip the login.

3. If it fails (no session), proceed with mp login as normal.

This matters because on a chat channel the user cannot see which account a command runs against. Without the confirmation step, an agent on a shared host can silently switch identities — and a "what's my balance" query returns someone else's portfolio. The check is one extra command; the alternative is a privacy incident.

Local wallet management

The CLI manages local wallets stored encrypted in ~/.config/moonpay/wallets.json. Private keys are encrypted with AES-256-GCM using a random key stored in your OS keychain. No password required — keys never leave the machine.

# Create a new HD wallet (Solana, Ethereum, Bitcoin, Tron)
mp wallet create --name "my-wallet"

# Import from a mnemonic (all chains)
mp wallet import --name "restored" --mnemonic "word1 word2 ..."

# Import from a private key (single chain)
mp wallet import --name "imported" --key <hex-key> --chain ethereum

# List all local wallets
mp wallet list

# Get wallet details (by name or address)
mp wallet retrieve --wallet "my-wallet"

# Export mnemonic/key (interactive only — agents cannot run this)
mp wallet export --wallet "my-wallet"

# Delete a wallet (irreversible)
mp wallet delete --wallet "my-wallet" --confirm

Workflow

1. Run mp user retrieve to check if authenticated. If a session already exists, follow the prompt rules in Before logging in above before starting a new login.
2. If no session, run mp login --email <email>, share the returned URL with the user, then run mp verify --email <email> --code <code> once they paste back the code from their email.
3. Run mp wallet list to see local wallets.
4. If no wallets, create one: mp wallet create --name "default".

Autonomous login

Agents can log in without human intervention if they have access to the user's email. For example, with the gog CLI (Google Workspace):

# 1. Send OTP
mp login --email [e-mail]

# 2. Read the OTP code from email
gog gmail search "Your MoonPay verification code" --max-results 1

# 3. Verify with the code
mp verify --email [e-mail] --code <code>

This enables fully autonomous agent setup — no human in the loop.

Config locations

• Wallets: ~/.config/moonpay/wallets.json (encrypted, AES-256-GCM)
• Encryption key: OS keychain (moonpay-cli / encryption-key)
• Credentials: ~/.config/moonpay/credentials.json (encrypted, AES-256-GCM)
• Config: ~/.config/moonpay/config.json (base URL, client ID)

Security

• Wallet secrets are always encrypted on disk
• Encryption key is stored in macOS Keychain / Linux libsecret
• No password to remember — the OS handles authentication
• wallet export requires an interactive terminal (TTY) — agents and scripts cannot extract secrets
• 24-word BIP39 mnemonics (256-bit entropy)

Related skills

• moonpay-swap-tokens — Swap or bridge tokens using local wallets.
• moonpay-check-wallet — Check wallet balances.