Can i whitelist urls on https://dashboard.web3auth.io programatically?

[himanshuchawla009]

• Is there any way to whitelist urls in developer dashboard from my backend?
• I am building a multi tenant application where i need to add a new sub domain for each my client whenever they signup in my app. Can i do it directly from my code?

[chaitanyapotti]

No need to whitelist on developer dashboard.
You can use manual origin whitelisting.

OpenLoginAdapter of web3auth accepts a parameter called OriginData.
OriginData is a key value pair
key: origin (e.g: https://a.example.com)
value: signature
signature is generated by using whitelistUrl function from the package @toruslabs/openlogin package

The parameters for whitelistUrl function are (clientId, clientSecret, origin)

[himanshuchawla009]

can you please provide a code snippet for generating signatures in the format supported by web3auth.

[chaitanyapotti]

To use the same function in the backend and generate the signature,

const base64url = require("base64url");
const keccak = require("keccak");
const { getPublic, sign } = require("@toruslabs/eccrypto");

const clientId = "BG0djgWQ8-sDz3OfdJmuQnO3XnsO8VOBhNGOSW8BgmgiNiit1374bM89r3RT0XP2n2BNkTS6A33UkQryCfkGbBs";
const clientSecret = "f785b7a8ef9e50bd878180c4b89072d08e8c2c59840bc01ef080f5b00783264e";
const origin = "https://www.example.com";
const appKeyBuf = Buffer.from(clientSecret.padStart(64, "0"), "hex");
if (base64url.encode(getPublic(appKeyBuf)) !== clientId) throw new Error("appKey mismatch");
const sig = await sign(appKeyBuf, Buffer.from(keccak("keccak256").update(origin).digest("hex"), "hex"));
const finalSig = base64url.encode(sig);
console.log("final sig", finalSig);

[billyjacoby]

The solution posted here is great if you aren't just running client side - but this doesn't allow me to use a wild card domain if i have a client side only application since I can't expose the secret there.

Is there still no way to add a wildcard domain to whitelist settings?

[marcus-sa]

Will wild card domains ever be supported..? This is ridiculous ...