Browser wallet provider

The IceRoot browser extension exposes window.iceroot on HTTPS websites and loopback development pages. The provider currently supports identity connection and validator-portal login messages.

1. Connect

if (!window.iceroot) {
  throw new Error('Open the page with the IceRoot extension installed.');
}

const identity = await window.iceroot.request({ method: 'connect' });

The wallet asks the user to approve the connection, then returns publicKey, address, network, and algorithm.

For the current adapter, the network is heartwood-devnet-v90 and the algorithm is secp256k1-bip340-sha256. Validate both before requesting a challenge.

2. Request the signature

Your portal server must create a fresh challenge bound to the requesting browser. Pass its exact message to the wallet:

const proof = await window.iceroot.request({
  method: 'signMessage',
  params: {
    message: challenge.message,
    publicKey: identity.publicKey,
    network: identity.network,
  },
});

The user reviews the full message in a wallet tab. The response contains publicKey, signature, network, and algorithm. Rejection, expiry, or a closed approval tab fails the request.

3. Verify on the server

Before issuing a session:

1. Retrieve the exact stored challenge.
2. Check the expected public key, network, origin, browser binding, and expiry.
3. Verify the signature against those exact message bytes.
4. Consume the challenge once.

The current portal challenges expire within five minutes.

The versioned sign-in format includes its purpose, website origin and URI, account, nonce, issue time, and expiry. Arbitrary free-form messages and transaction signing are outside this provider’s current contract.

No recovery phrase, private key, or wallet password crosses this interface. A valid identity signature also does not establish validator registration or rank.