Policy Reference

Policies are configured per project in the dashboard and evaluated after signature verification. All policies are optional. When multiple policies are set, they are evaluated in order: chain → allowlist → NFT → rate limit.

Chain allowlist

Restricts signing to wallets from specific chains. Requests signed on unlisted chains are rejected with 403 chain_not_allowed.

// Project config
{
  allowedChains: [8453, 84532]  // Base mainnet + Base Sepolia
}

On-chain allowlist

Calls isAllowed(address) on an on-chain contract. Only wallets that return true are permitted.

{
  policy: {
    allowlist: {
      contractAddress: "0xYourAllowlistContract",
      chainId: 8453
    }
  }
}

NFT gate

Requires the signing wallet to hold a minimum balance of an ERC-721 or ERC-1155 token.

{
  policy: {
    nftRequirement: {
      contractAddress: "0xYourNFTContract",
      chainId: 8453,
      minimumBalance: 1n  // default: 1
    }
  }
}

Rate limit

Per-wallet, per-path sliding window. Tracked in Redis (production) or memory (dev). Exceeding the limit returns 429 rate_limited.

{
  policy: {
    rateLimit: {
      requests: 100,       // max requests
      windowSeconds: 3600  // per hour, per wallet, per path
    }
  }
}

ERC-1271 smart accounts

Smart contract wallets (Safe, Coinbase Smart Wallet, etc.) are supported automatically. After normal signature verification fails, the middleware calls isValidSignature on the contract address. The actor.smartAccount flag is set to true in the context when this path is taken.