Ah ok, this is why I am confused.
I ended up following the “signature” work flow and use the /verify responseJson.address on my server back end to verify the user owns the wallet for the token that was sent to me in the manifold connect process on the client side…
client side:
let eth = window.ManifoldEthereumProvider;
await eth.initialize(this.network);
if (!eth.chainIsCorrect()) await eth.switchToCorrectChain();
await eth.connect();
let token = null;
if (this.appName != null) {
token = await eth.getOAuth({
grantType: "signature",
appName: this.appName,
clientId: this.clientId
});
let abtoken = await this.api.post("/manifold/verify", { token });
this.token = abtoken.data.token;
}
this.address = eth.selectedAddress();
server side:
const token = req.body.token;
const response = await axios.post("https://oauth2.manifoldxyz.dev/verify", { token });
const responseJson = response.data;
const address = responseJson.unwrappedJWT?.address;
let valid = await DBAPI.isWhitelisted(address);
if (valid) {
let user = await DBAPI.getUserByAddress(address);
let token = jwt.sign({ id: user.id }, process.env.TOKEN_SECRET, { expiresIn: 86400 });
console.log("logged in address", user.id, "address", address, "token", token);
req.session.manifoldToken = responseJson.access_token;
req.session.user = user;
res.json({ token });
I then store the responseJson.access_token in my user session and issue my own auth token to the user.
My assumption was that the access_token from the /verify response from manifold was sufficient to make data client requests on my server on behalf of the user.
But what I think I’m missing in the " Authorization Code Grant" flow is understanding the meaning of the “signature” query param that is referenced in the docs:
The Authorization Code Grant page references “access_token” as well, but I don’t know where the “signature” value comes from?
const response = await fetch('https://oauth2.manifoldxyz.dev/token', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Accept': 'application/json'
},
body: JSON.stringify({
clientId: clientId,
code: authCode,
clientSecret: clientSecret,
signature: signature
}),
})
also do I need to also call /token after /verify to be able to invoke dataclient methods serverside? This is where I’m stuck, and I’m not sure how to get a reference to the dataclient without installing an npm package.
Thanks for your help!
-Ryan