Reference

Transports

Options of PostMessageTransport, including how to allow several host origins.

A transport moves messages between the client and the wallet. Most apps never create one: pass appCenterOrigin to the client and it builds the right transport. Create a transport yourself only when something else must share it, such as HostStorageRelayAdapter.

`PostMessageTransport`

Used in embedded mode (the game runs in an iframe inside the App Center).

Option	Type	Default	Description
`appCenterOrigin`	`string \| string[]`	required	Exact origin of the host shell, for example `https://alpha.hydraone.app`, or a list of origins. A trailing slash is removed.
`targetWindow`	`PostMessageTarget`	`window.parent`	Window that receives outgoing messages.
`sourceWindow`	`MessageEventSource`	`window`	Window that emits incoming `message` events.
`env`	`string`	`process.env.NODE_ENV`, else `development`	Environment used for the wildcard check.
`checkIframeSource`	`boolean`	`true`	When inside an iframe, accept messages only from `window.parent`.
`defaultTimeoutMs`	`number`	`15000`	Default response timeout for requests.

Every incoming message is checked against appCenterOrigin first. A message from any other origin is rejected: the transport throws a HydraSecurityError (ERR_UNTRUSTED_ORIGIN) from its message handler, so the message is never processed. Because this happens inside a window message listener, it shows up as an uncaught error in the console rather than a rejected promise.

The wildcard '*' is accepted for local experiments, but the constructor throws HydraSecurityError when env is production.

Several host origins

Pass an array when the game can be embedded by more than one host, for example production and staging:

new PostMessageTransport({
  appCenterOrigin: ['https://alpha.hydraone.app', 'https://staging.hydraone.app'],
});

Messages are accepted from any listed origin.
postMessage takes a single target origin, so replies go to the origin of the last accepted message, then to the parent frame's origin when it is listed.
Before the host has been heard from (the first CLIENT_READY), the message is posted to each listed origin. The browser delivers it only to the window whose origin matches, and nothing is ever posted outside the list.
The list is trimmed, stripped of trailing slashes and de-duplicated. An empty list or a blank entry throws.
A '*' entry collapses the list to '*' and follows the wildcard rule above.
transport.allowedOrigins holds the full list and transport.appCenterOrigin the first entry.

Let the client create the transport

WalletBridgeClient also accepts appCenterOrigin (a string or an array). When no transport is given, the client creates the PostMessageTransport itself and destroys it in client.destroy(). A transport you pass always takes precedence and is never destroyed for you.

Transports

PostMessageTransport

Several host origins

Let the client create the transport

See also

`PostMessageTransport`