Backend

git clone https://github.com/rhinestonewtf/deposit-widget-proxy
cd deposit-widget-proxy
docker build -t deposit-widget-proxy .
docker run -p 4000:4000 -e RHINESTONE_API_KEY=your-key deposit-widget-proxy

import { Hono } from "hono";
import { cors } from "hono/cors";

const UPSTREAM = "https://v1.orchestrator.rhinestone.dev/deposit-processor";
const MODAL_VERSION_HEADER = "x-deposit-modal-version";

// Every route the modal calls, and nothing else. `:param` segments are matched
// by Hono, so a request can only reach a shape you listed here.
const ROUTES: [method: "get" | "post", path: string][] = [
  ["post", "/register-managed"],
  ["post", "/quotes/preview"],
  ["get", "/check/:address"],
  ["get", "/portfolio/:address"],
  ["get", "/portfolio/solana/:address"],
  ["get", "/deposits"],
  ["get", "/liquidity"],
  ["get", "/prices"],
  ["get", "/setup"],
  ["get", "/qr/tokens"],
  ["post", "/polymarket/withdraw"],
  // Only needed if you enable `assetMigrations` for a DeFi protocol (e.g. Aave).
  // Both are served by a read-scoped key: `unwind` writes nothing and returns an
  // unsigned transaction only the position holder's wallet can execute.
  ["get", "/positions/:address"],
  ["post", "/positions/:address/unwind"],
  ["post", "/onramp/swapped/widget-url"],
  ["post", "/onramp/swapped/connect-url"],
  ["get", "/onramp/swapped/connect-exchanges"],
  ["get", "/onramp/swapped/payment-methods"],
  ["get", "/onramp/swapped/status/:smartAccount"],
  // Safe to forward: the user's signature in the body is the authorization, so
  // your API key alone can't move funds through it. See below.
  ["post", "/deposits/recover"],
  // Add ["post", "/safe/withdraw"] only if your onSendTransaction relays through
  // it. Do NOT add /deposits/refund here — see below.
];

const app = new Hono();
app.use("*", cors());

for (const [method, path] of ROUTES) {
  app[method](path, async (c) => {
    const url = new URL(c.req.url);

    // A fresh header set, never the incoming one: the browser must not be able
    // to set `x-api-key` itself.
    const headers: Record<string, string> = {
      "Content-Type": "application/json",
      "x-api-key": process.env.RHINESTONE_API_KEY!,
    };
    const modalVersion = c.req.header(MODAL_VERSION_HEADER);
    if (modalVersion) headers[MODAL_VERSION_HEADER] = modalVersion;

    const res = await fetch(`${UPSTREAM}${url.pathname}${url.search}`, {
      method: c.req.method,
      headers,
      body: method === "get" ? undefined : await c.req.text(),
    });
    return new Response(res.body, { status: res.status });
  });
}

export default app;

allowHeaders: ["Content-Type", "x-deposit-modal-version"]

import { MODAL_VERSION } from "@rhinestone/deposit-modal/constants";