isFirstPartyApiBase
isFirstPartyApiBase(
apiBase):boolean
Defined in: safeUrl.ts:115
Is this apiBase first-party — the hosted SparkleTree edge, or loopback?
“First-party” is the fixed set of hosts SparkleTree itself operates:
sparkletree.io (the platform and the campaigns edge alias) and qrtree.ai
(the public edge origin the dashboard writes into every publishable key,
p.qrtree.ai). A key minted by the dashboard therefore mints as-is; a
hand-encoded key pointing anywhere else still gets content and no token.
The publishable key is an unsigned address ANYONE can hand-encode (see
publishableKey.ts), so an apiBase that arrived via a key proves nothing
about who chose it. The one value that must never follow an unproven
address is the signed mint token: it is a real spend credential, and a
doctored key pointing at an attacker host would receive it on the mint
POST and replay it against the real API for its TTL (security review
S-2). The mint therefore fires only when the apiBase is explicit (the
developer’s own prop — their choice to make), first-party, or loopback.
Self-hosted bases are exactly what the explicit apiBase escape hatch is
for; a self-made key carrying a third-party host gets content but no mint.
Parameters
Section titled “Parameters”apiBase
Section titled “apiBase”string
Returns
Section titled “Returns”boolean