Skip to content

isFirstPartyApiBase

isFirstPartyApiBase(apiBase): boolean

Defined in: safeUrl.ts:109

Is this apiBase first-party — the hosted SparkleTree edge, or loopback?

The publishable key is an unsigned address ANYONE can hand-encode (see publishableKey.ts), so an apiBase that arrived via a key proves nothing about who chose it. The one value that must never follow an unproven address is the signed mint token: it is a real spend credential, and a doctored key pointing at an attacker host would receive it on the mint POST and replay it against the real API for its TTL (security review S-2). The mint therefore fires only when the apiBase is explicit (the developer’s own prop — their choice to make), first-party, or loopback. Self-hosted bases are exactly what the explicit apiBase escape hatch is for; a self-made key carrying a third-party host gets content but no mint.

string

boolean