Core concepts

Security model

How the SDK validates origins and sources, limits waiting time and keeps keys and sessions safe.

Messages from the host

Origin allow-listing. PostMessageTransport accepts messages only from the configured appCenterOrigin (a single origin or a list of origins). Anything else is dropped before the payload is read.
Source check. Inside an iframe, messages must also come from window.parent. Disable it with checkIframeSource: false only in tests.
Targeted sends. Outgoing messages use the configured origin as targetOrigin. With several origins, replies go to the origin of the last accepted message; nothing is ever posted outside the list.
No wildcard in production. appCenterOrigin: '*' throws when env is production.

No key access. In embedded mode all signing happens in the host's wallet. The game never sees private keys.

Request timeouts. Four tiers (handshake 3 s, ping 3 s, query 15 s, signing 120 s) keep a silent host from hanging the game. Each can be overridden.
Safe storage failure. HostStorageRelayAdapter throws ERR_STORAGE_UNAVAILABLE instead of falling back to a storage where the session could leak or be wiped.

The SDK decodes JWTs and checks their expiry, but it never verifies signatures. Verification belongs to your backend.

Message protocol

The message envelope, request and response correlation, and the message types exchanged with the host.

Wallet operations

Read addresses and balances, then sign and submit transactions with proper error handling.