Accessory sessions from shortcuts

HTTPS shortcuts receive a fresh, origin-bound JWT in revibase_session:

https://game.xyz/play?revibase_session=eyJhbGciOiJFZERTQSIs…

Use it to grant accessory benefits. The linked wallet is context: an accessory tap does not prove control of that wallet's keys.

Verify on your server

Install jose (pnpm add jose), then verify the signature, issuer, audience, expiry, and claims before granting access:

import { createRemoteJWKSet, jwtVerify } from "jose";

const REVIBASE = "https://portal.revibase.com";
const APP_ORIGIN = "https://game.xyz"; // Configured origin, not the Host header.
const JWKS = createRemoteJWKSet(new URL(`${REVIBASE}/.well-known/session.json`));

const url = new URL(request.url);
const proof = url.searchParams.get("revibase_session");

if (proof) {
  const verified = await jwtVerify(proof, JWKS, {
    issuer: REVIBASE,
    audience: APP_ORIGIN,
    algorithms: ["EdDSA"],
    typ: "revibase-session+jwt",
  }).catch(() => null);

  const p = verified?.payload;
  if (
    p && typeof p.sub === "string" && typeof p.mint === "string" &&
    typeof p.jti === "string" && typeof p.exp === "number" &&
    (p.wallet === null || typeof p.wallet === "string") &&
    (p.authentication === "accessory" || p.authentication === "wallet") &&
    await markUsedOnce(p.jti, p.exp)
  ) {
    await createAccessorySession({
      accessory: p.sub,
      mint: p.mint,
      linkedWallet: p.wallet,
      authentication: p.authentication,
    });
  }

  url.searchParams.delete("revibase_session");
  return Response.redirect(url, 303);
}

Implement markUsedOnce as an atomic insert with a unique key or Redis SET NX; reject reused IDs and retain them until expiry. createAccessorySession is your app's session handler. Invalid proofs must not grant access.

Consume and remove the proof before loading analytics; avoid logging it. Embedded apps must support browsers that block third-party cookies.

Claims

Proofs expire within five minutes. authentication: "wallet" reflects an existing signed login, not a fresh signature at the destination.