MetaMask connection and wallet-login guide

Wallet connection

Install Blockchain Core first. MetaMask registers provider adapters for supported EVM and Solana targets while Core owns the shared session. Use the Terminal wallet panel or commands such as wallet, connect, metamask, mm, and wallet-status. A fresh page does not request accounts or present an old connection until the visitor acts. The provider bundle remains lazy until a reviewed wallet surface is visible, focused, or asked to connect.

Disconnecting clears the current browser session; it does not automatically remove a wallet deliberately linked to a WordPress account for login.

Login with wallet

Wallet login is a Pro feature for an existing WordPress user. Configure SnapWeb Auth first, open Cointacted → MetaMask, and enable the wallet method. Sign in normally once, then use Account Security or the terminal's Link with account action to link a connected wallet by signing the server-created challenge.

The current challenge follows Sign-In with Ethereum and binds the site domain, URI, active EVM chain, purpose, nonce, issue time, and expiry. EOA proofs are recovered locally; ERC-1271 contract wallets are verified against the trusted server RPC policy on the declared chain. An unavailable verification check fails closed.

MetaMask never creates a user account. SnapWeb Auth owns registration, password login, recovery, two-factor policy, routes, redirects, and session challenges. MetaMask owns provider interaction, proof verification, and wallet-to-user association.

End-to-end acceptance test

1. Open Cointacted → MetaMask and keep wallet login disabled. In a private browser window, confirm the Terminal shows a connect action but does not request an account automatically.
2. Connect the intended wallet, verify the displayed provider, network, and shortened address, then disconnect. Reload and confirm an old account is not presented as a fresh connection.
3. Enable wallet login, sign in with an existing WordPress account, and choose Link with account from Account Security or the Terminal. Sign the one-time challenge in MetaMask.
4. Sign out, choose the wallet login method, connect the same wallet, and sign the new login challenge. Confirm that the existing user is signed in and no duplicate WordPress user was created.
5. Replace or unlink the wallet and confirm the previous wallet can no longer sign in. The account's password and recovery methods must continue to work.

Run the acceptance test on every enabled EVM chain. Contract-wallet login also needs a trusted server RPC target for the declared chain; wallet connection alone does not prove ERC-1271 login readiness.

Account security

Signed-in users can connect, copy, replace, or unlink their wallet in Account Security. Replacing and unlinking require explicit confirmation and may require recent reauthentication. Unlinking removes wallet login only; it does not change the WordPress password. wallet-link and wallet-unlink expose the corresponding terminal actions when appropriate.

Troubleshooting and privacy

• MetaMask unavailable: install/enable the browser wallet and reload after unlocking it.
• Request already pending: complete or reject the request in MetaMask before trying again.
• Wrong network: switch through the reviewed network control; never assume an address implies a chain.
• Login says unlinked: sign in with the existing account and link that exact wallet first.
• Contract-wallet login unavailable: verify the declared chain has a trusted server RPC target.
• WalletConnect unavailable: it is intentionally a separate future/provider plugin and is not bundled.

Wallet addresses and association metadata participate in WordPress privacy export and erasure. Proofs, signatures, nonces, and provider session state are not stored as reusable login secrets.