Backend setup

git clone https://github.com/rhinestonewtf/deposit-widget-proxy
cd deposit-widget-proxy
docker build -t deposit-widget-proxy .
docker run -p 4000:4000 -e RHINESTONE_API_KEY=your-key deposit-widget-proxy

import { Hono } from "hono";
import { cors } from "hono/cors";

const UPSTREAM = "https://v1.orchestrator.rhinestone.dev/deposit-processor";
const MODAL_VERSION_HEADER = "x-deposit-modal-version";

// Every route the modal calls, and nothing else. `:param` segments are matched
// by Hono, so a request can only reach a shape you listed here.
const ROUTES: [method: "get" | "post" | "query", path: string][] = [
  ["get", "/chains"],
  ["post", "/register-managed"],
  ["post", "/quotes/preview"],
  ["get", "/check/:address"],
  ["get", "/portfolio/:address"],
  ["get", "/portfolio/solana/:address"],
  ["get", "/deposits"],
  ["get", "/liquidity"],
  ["get", "/prices"],
  ["get", "/assets"],
  ["query", "/assets"],
  ["get", "/setup"],
  ["get", "/qr/tokens"],
  ["post", "/polymarket/withdraw"],
  // Only needed if you enable `assetMigrations` for a DeFi protocol (e.g. Aave).
  // Both are served by a read-scoped key: `unwind` writes nothing and returns an
  // unsigned transaction only the position holder's wallet can execute.
  ["get", "/positions/:address"],
  ["post", "/positions/:address/unwind"],
  // Mints the short-lived token that attributes widget analytics to your
  // project. Omitting it costs attribution, never deposits — and its response
  // must not be cached, see below.
  ["post", "/analytics/ingest-token"],
  // Card and exchange on-ramp. `/onramp/orders/:id` only: never forward the
  // order list `GET /onramp/orders` with your key, it lists every user's orders.
  ["get", "/onramp/providers"],
  ["post", "/onramp/orders"],
  ["get", "/onramp/options"],
  ["get", "/onramp/orders/:id"],
  // Older modal versions call these instead. Drop them once you no longer
  // serve those versions.
  ["post", "/onramp/swapped/widget-url"],
  ["post", "/onramp/swapped/connect-url"],
  ["get", "/onramp/swapped/connect-exchanges"],
  ["get", "/onramp/swapped/payment-methods"],
  ["get", "/onramp/swapped/status/:smartAccount"],
  // Safe to forward: the user's signature in the body is the authorization, so
  // your API key alone can't move funds through it. See below.
  ["post", "/deposits/recover"],
  // Gasless permit deposits, safe for the same reason: the user's token
  // authorization signature in the body is what moves the funds.
  ["post", "/deposits/permit/prepare"],
  ["post", "/deposits/permit"],
  // Add ["post", "/safe/withdraw"] only if your onSendTransaction relays through
  // it. Do NOT add /deposits/refund here — see below.
];

const app = new Hono();
// Reflects whatever origin asks. Narrow this and you must list our hosted
// embed origin too — see CORS, origins and the version header below.
app.use("*", cors({ origin: (origin) => origin, allowMethods: ["GET", "POST", "QUERY", "OPTIONS"] }));

for (const [method, path] of ROUTES) {
  app.on(method.toUpperCase(), path, async (c) => {
    const url = new URL(c.req.url);

    // A fresh header set, never the incoming one: the browser must not be able
    // to set `x-api-key` itself.
    const headers: Record<string, string> = {
      "Content-Type": "application/json",
      "x-api-key": process.env.RHINESTONE_API_KEY!,
    };
    const modalVersion = c.req.header(MODAL_VERSION_HEADER);
    if (modalVersion) headers[MODAL_VERSION_HEADER] = modalVersion;

    const res = await fetch(`${UPSTREAM}${url.pathname}${url.search}`, {
      method: c.req.method,
      headers,
      body: method === "get" ? undefined : await c.req.text(),
    });
    const noStore = path === "/analytics/ingest-token";
    return new Response(res.body, {
      status: res.status,
      headers: noStore ? { "Cache-Control": "no-store" } : undefined,
    });
  });
}

export default app;

virtualAccountOnramp={{}}
getCustomerSession={async (smartAccount, options) => {
  const response = await fetch("/api/customer-session", {
    method: "POST",
    credentials: "same-origin",
    headers: { "Content-Type": "application/json" },
    // Forward `options`: History's `resumeOnly` must reach the helper.
    body: JSON.stringify({ smartAccount, ...options }),
    cache: "no-store",
  });
  if (!response.ok) {
    // Keep the refusal's code (e.g. ACCOUNT_CHANGE_REQUIRES_MIGRATION),
    // so the modal can explain it instead of offering a retry.
    const { code } = await response.json().catch(() => ({}));
    throw Object.assign(new Error("Customer session unavailable"), { code });
  }
  return response.json();
}}

https://deposit.rhinestone.dev

cors({ origin: ["https://yourapp.com", "https://deposit.rhinestone.dev"], allowMethods: ["GET", "POST", "QUERY", "OPTIONS"] })

allowHeaders: ["Content-Type", "x-deposit-modal-version"]

import { MODAL_VERSION } from "@rhinestone/deposit-modal/constants";