[SDK] Fix: Route in-app wallet OTP login through getClientFetch

[blockgroot]

Fixes #8774

Notes for the reviewer

sendOtp/verifyOtp (packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.ts) built request headers by hand and called the global fetch directly, instead of going through getClientFetch like every other in-app wallet call (rg -l "getClientFetch" packages/thirdweb/src/wallets/in-app/ → 18 files; otp.ts was the only file in that tree calling bare fetch).

getClientFetch is the only place that attaches platform headers, including x-bundle-id on React Native (via getPlatformHeaders() in utils/fetch.ts). Because OTP login skipped it, x-bundle-id was never sent — even when it was available from globalThis.Application.applicationId. Since the backend enforces the Bundle ID access restriction on this endpoint, any client ID with that restriction configured rejected every email/phone OTP login with a 401 UNAUTHORIZED, and the only workaround was disabling the restriction ("Allow all bundle IDs") entirely.

Fix: route both functions through getClientFetch(client, ecosystem), matching the existing pattern in siwe.ts (the closest analog — another login endpoint on the same host). Dropped the now-redundant manual x-client-id/x-ecosystem-id/x-ecosystem-partner-id headers since getClientFetch sets those itself; kept only Content-Type, which it doesn't set.

Confirmed the swap is safe: both URLs resolve to embedded-wallet.thirdweb.com, which getClientFetch's isInAppWalletUrl branch already excludes from the Bearer-token/auth-token path — so this only adds the missing headers, it doesn't change which credential gets sent.

How to test

Added otp.test.ts, following the vi.mock/vi.mocked(getClientFetch).mockReturnValue(...) pattern already used in backend.test.ts:

• sendOtp/verifyOtp call getClientFetch(client, ecosystem) and invoke the returned fetch.
• Before this fix, mocking getClientFetch did nothing (the real fetch still fired), so the tests hit the live API and failed (KEY_NOT_FOUND / Failed to verify verification code) — that failure is the proof the bug existed.
• Added a case per function asserting the ecosystem argument is forwarded, since that's exactly the branch the old manual-header code depended on.

cd packages/thirdweb
pnpm test:dev src/wallets/in-app/web/lib/auth/otp.test.ts
pnpm test:dev src/wallets/in-app/web/lib/web-connector.test.ts   # caller, no regressions

Both green (10/10). biome check on the changed files is clean.

---

PR-Codex overview

This PR focuses on improving the OTP login functionality by ensuring that the sendOtp and verifyOtp functions use getClientFetch instead of the global fetch. This change allows the necessary platform headers to be attached, enabling proper authentication with Bundle ID access restrictions.

Detailed summary

• Updated sendOtp and verifyOtp to use getClientFetch instead of global fetch.
• Removed unnecessary headers (x-client-id, x-ecosystem-id, x-ecosystem-partner-id) from sendOtp and verifyOtp.
• Added tests to ensure requests route through getClientFetch and attach necessary headers.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

Summary by CodeRabbit

• Bug Fixes

  • Improved in-app wallet email and phone OTP requests by ensuring required SDK platform information is included.
  • Preserved optional ecosystem details during OTP authentication requests.

• Tests

  • Added coverage for sending and verifying OTPs, including request handling and optional ecosystem data.

[changeset-bot]

🦋 Changeset detected

Latest commit: abb7e20

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
thirdweb	Patch
@thirdweb-dev/nebula	Patch
@thirdweb-dev/wagmi-adapter	Patch
wagmi-inapp	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@blockgroot is attempting to deploy a commit to the thirdweb Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 13cde47b-4157-4700-9d1c-753c477846ad

📥 Commits

Reviewing files that changed from the base of the PR and between 07fcec0 and df54ba2.

📒 Files selected for processing (3)

• .changeset/fix-otp-getclientfetch-bundle-id.md
• packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.test.ts
• packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.ts

---

Walkthrough

OTP email and phone requests now use getClientFetch for sending and verification. Tests cover client-fetch routing and ecosystem forwarding. A patch changeset documents the transport update.

Changes

OTP transport

Layer / File(s)	Summary
Route OTP requests through getClientFetch packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.ts, packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.test.ts, .changeset/fix-otp-getclientfetch-bundle-id.md	sendOtp and verifyOtp use getClientFetch(client, ecosystem) and keep only the Content-Type request header. Tests verify client-fetch routing, successful responses, and ecosystem forwarding. The changeset documents the patch release.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to df54b

This localized change routes OTP requests through the shared client fetch path and adds focused tests; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: 0xfirekeeper

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes routing in-app wallet OTP login through getClientFetch.
Description check	✅ Passed	The description includes reviewer notes, testing steps, test results, and a clear explanation of the fix.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

This PR has been inactive for 7 days. It is now marked as stale and will be closed in 2 days if no further activity occurs.