feat: Add optional JWT token authentication to multi-chain accounts API #7165
+176
−92
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
|
@metamaskbot publish-preview |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
|
Preview builds have been published. See these instructions for more information about preview builds. Expand for full list of packages and versions. |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
There was a problem hiding this comment.
Bug: Test timeout value doesn't match updated constant
The test comment and advanceTime call use 30000ms to simulate the timeout, but ACCOUNTS_API_TIMEOUT_MS was changed from 30000 to 10000 in TokenDetectionController.ts. The test advances time by 30000ms when it should advance by 10000ms to properly test the timeout behavior. This causes the test to wait 3x longer than necessary and doesn't accurately test the actual timeout threshold.
packages/assets-controllers/src/TokenDetectionController.test.ts#L2833-L2836
core/packages/assets-controllers/src/TokenDetectionController.test.ts
Lines 2833 to 2836 in 71af222
Prithpal-Sooriya
approved these changes
Nov 21, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Explanation
What is the current state and why does it need to change?
Currently, the multi-chain accounts API calls in
TokenDetectionControllerandTokenBalancesControllerare made without authentication. This limits the ability to provide user-specific data and secure API endpoints that require authenticated requests.What is the solution and how does it work?
This PR adds optional JWT token authentication and timeout protection to the accounts API calls:
API Layer Changes (
multi-chain-accounts.ts):jwtTokenparameter tofetchMultiChainBalancesandfetchMultiChainBalancesV4Authorization: Bearer <token>headerController Integration:
AuthenticationController:getBearerTokenand passes it tofetchMultiChainBalanceswhen detecting tokens via Accounts APIfetchMultiChainBalancesV4Balance Fetcher Updates (
api-balance-fetcher.ts):AccountsApiBalanceFetcherto accept and pass JWT token through the fetch chainupdateBalances→fetch→#fetchBalances→ API callsKey Design Decisions
References
Checklist
TokenDetectionController.test.tsto verify JWT token is passed correctlyTokenDetectionController.test.tsto verify 30-second timeout triggers RPC fallbackTokenBalancesController.test.tsto verify JWT token flows through balance fetchermulti-chain-accounts.test.tsto verify Authorization header is set correctlyadvanceTimehelperfetchMultiChainBalancesandfetchMultiChainBalancesV4Note
Adds optional JWT bearer authentication to multi‑chain Accounts API calls and wires token retrieval through controllers, while lowering timeouts to 10s and reducing API batch size to 20.
jwtTokentofetchMultiChainBalances/fetchMultiChainBalancesV4; includeAuthorization: Bearer <token>header when provided.10s; reduce V4 batch size from50to20.TokenDetectionControllerandTokenBalancesControllerfetch JWT viaAuthenticationController:getBearerTokenand pass it through balance/token detection flows.TokenDetectionControllerAccounts API timeout lowered to10s.AccountsApiBalanceFetcheraccepts/forwardsjwtToken; applies 10s timeout and 20-size batching.AuthenticationController:getBearerTokenand token list state injection.@metamask/profile-sync-controlleras dev/peer dep.CHANGELOG.mdto document the new optional auth.Written by Cursor Bugbot for commit d645dcf. This will update automatically on new commits. Configure here.