Customize the tap page

Host shortcuts.json at your NFT's HTTPS external_url plus /shortcuts.json. For https://game.xyz/season, publish https://game.xyz/season/shortcuts.json. Revibase fetches it server-side; no CORS setup is needed.

{
  "version": 2,
  "shortcuts": [
    {
      "label": "Play",
      "uri": "https://game.xyz/play/{{tokenId}}",
      "icon": "gaming",
      "revibase": { "launch": "embed" }
    },
    {
      "label": "Stake NFT",
      "uri": "https://staking.example/stake?mint={{tokenId}}",
      "icon": "stake",
      "revibase": { "launch": "wallet" }
    },
    {
      "label": "Website",
      "uri": "https://game.xyz",
      "icon": "generic-link",
      "revibase": { "launch": "browser" }
    }
  ]
}

Revibase shows up to 8 shortcuts in file order. Updates may take 10 minutes. Every listed HTTPS destination, including third-party sites, receives a session proof. Sites that do not integrate proofs can ignore it.

Choose a launch mode

`revibase.launch`	Behavior
`embed`	Opens an iframe inside Revibase. Use for experiences that do not need wallet signing.
`wallet`	Use for staking and other wallet apps. Opens in place inside a wallet browser. Otherwise uses the user's browser or wallet-app preference; desktop normally opens a new tab. Missing or forgotten preferences prompt selection.
`browser`	Opens an HTTPS destination in a new tab, or requests one inside a wallet browser. Also supports `solana:` URIs, which receive no proof.

Wallet app preferences are local to each browser and accessory. Users can forget an accessory’s linked wallet details without unlinking it. Your destination must connect its own wallet. Launching cannot select an account or carry over Revibase's wallet connection. For owner-only actions, follow the session proof checks.

Fields

Field	Value
`label`	Display label, clipped to 32 characters.
`uri`	Absolute HTTPS URL on any hostname; `solana:` only with `browser`.
`revibase.launch`	`embed`, `wallet`, or `browser`. Invalid or missing values in a supplied `revibase` object hide the entry.
`icon`	Named icon below, or HTTPS PNG, JPEG, WebP, GIF, or AVIF up to 128 KB. SVG is unsupported.
`platform`	`all` (default), `desktop`, or `mobile`.
`limitToCollections`	Optional array of collection addresses.
`type`	Omit or set to `collectible`.

URL placeholders: {{tokenId}} is the NFT mint; {{collectionId}} is its DAS collection; {{ownerAddress}} is the accessory's linked wallet. Missing or unknown placeholders hide the entry. Unclaimed accessories have no ownerAddress.

Named icons: gaming, gaming-2, stake, stake-2, mint, mint-2, vote, vote-2, view, chat, tip, leaderboard, discord, x, twitter, instagram, telegram, generic-link, generic-add.

Allow embedding

Embedded project page inside Revibase with close and external-open controls App mockup: an embed shortcut opens your page inside Revibase.

Return this HTTP response header from your embedded page:

Content-Security-Policy: frame-ancestors 'self' https://portal.revibase.com

The page must return a successful response without a cross-origin redirect. Every enforced frame-ancestors policy must allow Revibase; without that directive, remove X-Frame-Options. Failed framing checks fall back to the wallet launch flow.

Do not depend on injected wallets, passkeys, top navigation, or third-party cookies in the iframe. Use a session proof for accessory access and wallet for signing.

Existing Phantom files

revibase.launch overrides Phantom's presentation fields. Without revibase, prefersExternalTarget: true opens a browser link; otherwise the URL must use the project hostname or a subdomain and follows the wallet flow. Explicit preferredPresentation: "immerse" requests embedding; Revibase does not use Phantom's implicit immerse default.