Skip to content

feat(wallet): add optional Infura auth token to network controller options - #9927

Open
basgys wants to merge 2 commits into
MetaMask:mainfrom
basgys:feat/network-controller-infura-auth-token
Open

feat(wallet): add optional Infura auth token to network controller options#9927
basgys wants to merge 2 commits into
MetaMask:mainfrom
basgys:feat/network-controller-infura-auth-token

Conversation

@basgys

@basgys basgys commented Aug 20, 2026

Copy link
Copy Markdown

Explanation

NetworkController already accepts getRpcServiceOptions, which customizes the RpcService built for each RPC endpoint, including the fetch it uses. @metamask/wallet forwards nothing to it, so a client has no way to influence RPC requests.

This adds getInfuraAuthToken to the networkController instance options:

const wallet = new Wallet({
  instanceOptions: {
    networkController: {
      infuraProjectId,
      getInfuraAuthToken: () => getBearerToken(),
    },
  },
});

When supplied, the token it returns is presented as Authorization: Bearer on requests to Infura RPC endpoints. Omitting it leaves request behavior unchanged.

Endpoints are matched by hostname. A client configured as NetworkClientType.Infura can still direct traffic elsewhere: getAvailableEndpoints puts failover URLs in the same chain, and under rpcFailoverMode: 'forced' it bypasses Infura entirely. Matching on the client type would hand the credential to a failover provider. create-network-client.ts already checks the hostname for this reason, noting that some networks have been added with invalid configuration types.

The token is read per request. getRpcServiceOptions runs once when the RpcService is constructed, so a value captured there would pin whatever the token was at that moment. Wrapping fetch picks up a refreshed token on the next request.

A token that cannot be retrieved leaves the request unauthenticated. A request that already carries an Authorization header keeps it, since RpcService sets one for endpoints whose URL embeds credentials.

@metamask/wallet now occupies getRpcServiceOptions unconditionally, so a future instance option wanting to customize RPC services has to compose with this function. If the token belongs on the Infura path proper, a first-class option on NetworkController threaded to the Infura branch in create-network-client.ts is the more honest home. That is a two-package change, which is why this starts smaller.

References

None.

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

…tions

Adds `getInfuraAuthToken` to the `networkController` instance options. When
supplied, the token it returns is presented as a bearer credential on requests
to Infura RPC endpoints.

Endpoints are matched by hostname rather than by network client type, since a
network client configured as Infura can still direct traffic elsewhere through
its failover URLs, and only the endpoints served by Infura should carry the
token. Requests that already carry an `Authorization` header keep it.

The token is retrieved per request, so one that is refreshed during the
lifetime of a network client is picked up on the next request. A failure to
retrieve it leaves the request unauthenticated rather than failing it.

Omitting the option leaves request behavior unchanged.
@basgys
basgys requested a review from a team as a code owner August 20, 2026 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant