feat: add allowedIp to moonpay signature generation (#3375)
Konstantin Ullrich committed
Jul 14, 2026 at 15:49 UTC
1241b28becc5cde7f5fcb73527fe0a51ca762bde
2 files changed
+11
-13
lib/buy/moonpay/moonpay_provider.dart
+10
-13
@@ -79,7 +79,7 @@ class MoonPayProvider extends BuyProvider {
79
@override
80
bool get isAggregator => false;
81
82
- static String get _apiKey => secrets.moonPayApiKey;
82
+ String get _apiKey => isTestEnvironment ? secrets.moonPaySandboxApiKey : secrets.moonPayApiKey;
83
84
String get currencyCode => walletTypeToCryptoCurrency(wallet.type, chainId: wallet.chainId).title.toLowerCase();
85
@@ -96,8 +96,9 @@ class MoonPayProvider extends BuyProvider {
96
}
97
}
98
99
- Future<String> getMoonpaySignature(String query) async {
100
- final uri = Uri.https(_cIdBaseUrl, "/api/moonpay");
99
+ Future<String> getMoonpaySignedQuery(String query) async {
100
+ final uri =
101
+ Uri.https(_cIdBaseUrl, "/api/moonpay", isTestEnvironment ? {"useSandbox": "true"} : null);
102
103
final response = await ProxyWrapper().post(
104
clearnetUri: uri,
@@ -107,7 +108,8 @@ class MoonPayProvider extends BuyProvider {
108
109
110
if (response.statusCode == 200) {
110
- return (jsonDecode(response.body) as Map<String, dynamic>)['signature'] as String;
111
+ printV((jsonDecode(response.body) as Map<String, dynamic>));
112
+ return (jsonDecode(response.body) as Map<String, dynamic>)['query'] as String;
113
} else {
114
throw Exception(
115
'Provider currently unavailable. Status: ${response.statusCode} ${response.body}');
@@ -297,18 +299,13 @@ class MoonPayProvider extends BuyProvider {
299
required Map<String, String> params,
300
String? amount,
301
}) async {
300
- if (_apiKey.isNotEmpty) params['apiKey'] = _apiKey;
302
+ if (_apiKey.isNotEmpty) params["apiKey"] = _apiKey;
303
304
final baseUrl = isBuyAction ? baseBuyUrl : baseSellUrl;
303
- final originalUri = Uri.https(baseUrl, '', params);
305
+ final originalUri = Uri.https(baseUrl, "", params);
306
305
- if (isTestEnvironment) return originalUri;
306
-
307
- final signature = await getMoonpaySignature('?${originalUri.query}');
308
- final query = Map<String, dynamic>.from(originalUri.queryParameters);
309
- query['signature'] = signature;
310
- final signedUri = originalUri.replace(queryParameters: query);
311
- return signedUri;
307
+ final query = await getMoonpaySignedQuery("?${originalUri.query}");
308
+ return Uri.parse(query);
309
}
310
311
Future<Order> findOrderById(String id) async {
tool/utils/secret_key.dart
+1
@@ -18,6 +18,7 @@ class SecretKey {
18
SecretKey('wyreApiKey', () => ''),
19
SecretKey('wyreAccountId', () => ''),
20
SecretKey('moonPayApiKey', () => ''),
21
+ SecretKey('moonPaySandboxApiKey', () => ''),
22
SecretKey('moonPaySecretKey', () => ''),
23
SecretKey('sideShiftAffiliateId', () => ''),
24
SecretKey('simpleSwapApiKey', () => ''),