Generate an NWC connection string via the API

[danieldaquino]

I was investigating how we can easily setup lightning wallets for Damus users during onboarding as part of damus-io/damus#1623, and we would love to use the Coinos API to help with making the process as easy as possible for the user.

I was studying the API documentation listed here, but unfortunately I could not find a way to generate an NWC wallet via the API.

Is it possible to generate an NWC wallet using the API, or would it be feasible to implement a new endpoint that does that? Some notes:

• We probably don't need to customize NWC parameters at this point (such as custom spend limits), just generating an NWC wallet with reasonable defaults and getting the NWC info back would be sufficient for our purposes.
• I could try to help with implementation if needed!

I appreciate any assistance with this, thank you!

[asoltys]

Hi @danieldaquino yes it's possible to use the API but you would need the user's JWT auth token

It might be better to follow a similar flow as bitcoin connect that recently implemented: getAlby/bitcoin-connect#263

Basically directing users to a URL like this: https://coinos.io/apps/new?name=myconnection&pubkey=123456&max_amount=10000&budget_renewal=daily

Where the pubkey is derived from a random secret key that Damus would generate and store locally.

If the user is logged into Coinos in their browser already they should just be able to submit the form that will be pre-filled from the query params. If not they will be prompted to either login or register, and then redirected to the form to add the NWC connection.

[asoltys]

@rolznz

[asoltys]

The user can click the big purple "Connect" button after adding the connection in Coinos which will send the connection details back to Damus via deeplink as long as it's the default handler for the nostr+walletconnect: protocol on the users' device.

[asoltys]

If you do just want to add a new connection via the API you can POST to /app like so:

curl https://coinos.io/api/app -d '{"name": "Damus", "pubkey":"<thepubkey>","secret":"<thesecretkey>","max_fee":200,"max_amount":10000,"budget_renewal":"weekly"}' -H 'content-type: application/json' -H "Authorization: Bearer <the-jwt-token>"

[asoltys]

I should also mention we have a /nostrAuth endpoint that you can use to login to or register a Coinos account by signing an event.

It might work out nicely since you guys have the user's nsec

import { bytesToHex, randomBytes } from "@noble/hashes/utils";
import { finalizeEvent, getPublicKey } from "nostr-tools";

const sk = randomBytes(32);

console.log("Getting auth challenge code");

const { challenge } = await fetch("https://coinos.io/api/challenge").then((r) =>
	r.json(),
);

console.log("Creating auth event");

const event = finalizeEvent(
	{
		kind: 27235,
		created_at: Date.now(),
		content: "",
		tags: [
			["u", "https://coinos.io/api/nostrAuth"],
			["method", "POST"],
			["challenge", challenge],
		],
	},
	sk,
);

console.log("Authenticating");

const { token } = await fetch("https://coinos.io/api/nostrAuth", {
	method: "POST",
	body: JSON.stringify({ challenge, event }),
	headers: { "content-type": "application/json" },
}).then((r) => r.json());

console.log("JWT for API authorization:", token);

const bytes = randomBytes(32);
const secret = bytesToHex(bytes);
const pubkey = getPublicKey(bytes);

const app = {
	name: "Damus",
	pubkey,
	secret,
	max_amount: 10000,
	budget_renewal: "weekly",
};

console.log("Creating NWC connection", app);

const r = await fetch("https://coinos.io/api/app", {
	method: "POST",
	body: JSON.stringify(app),
	headers: {
		"content-type": "application/json",
		Authorization: `Bearer ${token}`,
	},
});

if (r.ok) console.log("NWC connection created!");
else console.log("Something went wrong");

[rolznz]

The user can click the big purple "Connect" button after adding the connection in Coinos which will send the connection details back to Damus via deeplink as long as it's the default handler for the nostr+walletconnect: protocol on the users' device.

@asoltys there is also a return_to parameter that could be used to immediately redirect to e.g. damus:// after connecting.

[rolznz]

The nostrAuth endpoint looks nice for brand new users since all this can be automated, allowing the user to receive a coinos account and wallet without having to exit Damus. This would be a nice default and alternative to the cashu wallet flows some clients have.

For users who want to connect an existing wallet, there are improved flows for connecting both custodial and self-custodial NWC wallets. My proposal is here and I would love feedback: nostr-protocol/nips#1818

[danieldaquino]

Thanks for all the info! I will try to implement some of these!

[danieldaquino]

I should also mention we have a /nostrAuth endpoint that you can use to login to or register a Coinos account by signing an event.

It might work out nicely since you guys have the user's nsec

import { bytesToHex, randomBytes } from "@noble/hashes/utils";
import { finalizeEvent, getPublicKey } from "nostr-tools";

const sk = randomBytes(32);

console.log("Getting auth challenge code");

const { challenge } = await fetch("https://coinos.io/api/challenge").then((r) =>
r.json(),
);

console.log("Creating auth event");

const event = finalizeEvent(
{
kind: 27235,
created_at: Date.now(),
content: "",
tags: [
["u", "https://coinos.io/api/nostrAuth"],
["method", "POST"],
["challenge", challenge],
],
},
sk,
);

console.log("Authenticating");

const { token } = await fetch("https://coinos.io/api/nostrAuth", {
method: "POST",
body: JSON.stringify({ challenge, event }),
headers: { "content-type": "application/json" },
}).then((r) => r.json());

console.log("JWT for API authorization:", token);

const bytes = randomBytes(32);
const secret = bytesToHex(bytes);
const pubkey = getPublicKey(bytes);

const app = {
name: "Damus",
pubkey,
secret,
max_amount: 10000,
budget_renewal: "weekly",
};

console.log("Creating NWC connection", app);

const r = await fetch("https://coinos.io/api/app", {
method: "POST",
body: JSON.stringify(app),
headers: {
"content-type": "application/json",
Authorization: Bearer ${token},
},
});

if (r.ok) console.log("NWC connection created!");
else console.log("Something went wrong");

@asoltys, I tried this method, but I am hitting HTTP 401 (Not authorized) errors on the https://coinos.io/api/nostrAuth endpoint. I ran into this error on both my prototype implementation and the sample code provided. Are there any other steps needed to register for a new account using Nostr Auth?

[danieldaquino]

@asoltys, I tried this method, but I am hitting HTTP 401 (Not authorized) errors on the https://coinos.io/api/nostrAuth endpoint. I ran into this error on both my prototype implementation and the sample code provided. Are there any other steps needed to register for a new account using Nostr Auth?

Nevermind, Will pointed out there are benefits in using the username+password method — so we will be trying out that approach instead for user sign up.

Thanks!

[asoltys]

Ok, I think I may have fixed the nostrAuth issue anyways in case you end up needing it.

[danieldaquino]

I was able to generate the NWC connection string via the API in the end, thank you @asoltys for the help!

I believe this issue can be closed, but please feel free to reopen if needed. Thanks!