1

Problem: Our users are able to create NFTs during their experience with our dApp. However, we require these newly created NFTs also to be recognized as part of the same Metaplex Certified Collection. This is required because we want the NFTs to be recognized as part of our official collection on MagicEden and other marketplaces, and also be verifiable on chain for their authenticity. But to do this, we have to sign the transaction using the authority keypair of the Metaplex Certified Collection. Using the authority keypair to sign the NFTs in the frontend would risk exposing the private key in the front-end code which can compromise it. The transaction is then signed by the future owner of the NFT as well (the current connected wallet). How to execute signing by the authority keypair without compromising the private key?

Context: This is for an application where users can engage with the app and create new NFTs. We want to support Metaplex Certified Collections in our app.

Proposed solution: Write the process of NFT generation as a backend service and send the transactions in a serialized format to the frontend. In the backend, the authority keypair of the Metaplex Certified Collection can also sign the transaction without any compromise of the private keys. Once the serialized transactions are received by the frontend, the connected wallet can sign the serialized transactions at once, pay the necessary fee and send the transaction to the chain for confirmation.

Is there a more efficient way to solve this problem than the proposed solution? We are looking for a safe, risk-averse way to solve for this. Would appreciate your help on this.

1 Answer 1

1

You can use transaction.partialSign on your backend to partially sign the transaction with your keypair and then the user can decode serialized transactions and sign with his keypair.

transaction.partialSign(metaplexCertifiedCollectionKeypair);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.