Access-control application patterns

Protected downloads

Authenticate the application user, resolve the intended identity, obtain current ownership evidence through a supported trusted integration, and only then return a short-lived download URL. Do not return a protected URL to the browser and rely on hiding its button.

Sigma's first-party wallet verification route requires a Sigma session and currently checks the primary profile. An application OAuth token does not automatically bridge that session boundary. If the app cannot access the required route with a supported credential, use its own wallet challenge and indexer check; do not relay a user-supplied boolean.

NFT count tiers

Store your collection/origin IDs and positive-integer thresholds in server configuration. Compare trusted observed counts to those thresholds. Treat missing wallet connections, stale results, and upstream failures as insufficient evidence, and let the user retry after checking the correct primary profile.

Changes after login

NFT ownership can change while an application session remains valid. OAuth sign-in does not freeze holdings. Recheck before valuable actions, and document any cached-access period to users. Do not claim automatic transfer detection or immediate entitlement revocation unless your own backend implements it.

Test cases

Use controlled staging fixtures for no wallet, wrong primary profile, matching/nonmatching origin, collection metadata mismatch, multiple addresses, more than 100 indexer results, and upstream failure. Verify a forged browser request cannot grant access and that a revoked local session cannot retrieve the protected resource.

See the wallet API for endpoint shapes and thresholds for counting semantics.