isFirstPartyApiBase
isFirstPartyApiBase(
apiBase):boolean
Defined in: safeUrl.ts:109
Is this apiBase first-party — the hosted SparkleTree edge, or loopback?
The publishable key is an unsigned address ANYONE can hand-encode (see
publishableKey.ts), so an apiBase that arrived via a key proves nothing
about who chose it. The one value that must never follow an unproven
address is the signed mint token: it is a real spend credential, and a
doctored key pointing at an attacker host would receive it on the mint
POST and replay it against the real API for its TTL (security review
S-2). The mint therefore fires only when the apiBase is explicit (the
developer’s own prop — their choice to make), first-party, or loopback.
Self-hosted bases are exactly what the explicit apiBase escape hatch is
for; a self-made key carrying a third-party host gets content but no mint.
Parameters
Section titled “Parameters”apiBase
Section titled “apiBase”string
Returns
Section titled “Returns”boolean