[SDK] Fix: Route in-app wallet OTP login through getClientFetch

[blockgroot]

Fixes #8774

Notes for the reviewer

sendOtp/verifyOtp (packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.ts) built request headers by hand and called the global fetch directly, instead of going through getClientFetch like every other in-app wallet call (rg -l "getClientFetch" packages/thirdweb/src/wallets/in-app/ → 18 files; otp.ts was the only file in that tree calling bare fetch).

getClientFetch is the only place that attaches platform headers, including x-bundle-id on React Native (via getPlatformHeaders() in utils/fetch.ts). Because OTP login skipped it, x-bundle-id was never sent — even when it was available from globalThis.Application.applicationId. Since the backend enforces the Bundle ID access restriction on this endpoint, any client ID with that restriction configured rejected every email/phone OTP login with a 401 UNAUTHORIZED, and the only workaround was disabling the restriction ("Allow all bundle IDs") entirely.

Fix: route both functions through getClientFetch(client, ecosystem), matching the existing pattern in siwe.ts (the closest analog — another login endpoint on the same host). Dropped the now-redundant manual x-client-id/x-ecosystem-id/x-ecosystem-partner-id headers since getClientFetch sets those itself; kept only Content-Type, which it doesn't set.

Confirmed the swap is safe: both URLs resolve to embedded-wallet.thirdweb.com, which getClientFetch's isInAppWalletUrl branch already excludes from the Bearer-token/auth-token path — so this only adds the missing headers, it doesn't change which credential gets sent.

How to test

Added otp.test.ts, following the vi.mock/vi.mocked(getClientFetch).mockReturnValue(...) pattern already used in backend.test.ts:

• sendOtp/verifyOtp call getClientFetch(client, ecosystem) and invoke the returned fetch.
• Before this fix, mocking getClientFetch did nothing (the real fetch still fired), so the tests hit the live API and failed (KEY_NOT_FOUND / Failed to verify verification code) — that failure is the proof the bug existed.
• Added a case per function asserting the ecosystem argument is forwarded, since that's exactly the branch the old manual-header code depended on.

cd packages/thirdweb
pnpm test:dev src/wallets/in-app/web/lib/auth/otp.test.ts
pnpm test:dev src/wallets/in-app/web/lib/web-connector.test.ts   # caller, no regressions

Both green (10/10). biome check on the changed files is clean.

---

PR-Codex overview

This PR focuses on improving the OTP login process for in-app wallets by ensuring that requests route through getClientFetch, allowing necessary platform headers to be attached, specifically addressing issues with the x-bundle-id header.

Detailed summary

• Updated sendOtp and verifyOtp functions to use getClientFetch instead of the global fetch.
• Removed direct setting of x-client-id, x-ecosystem-id, and x-ecosystem-partner-id headers in favor of using getClientFetch.
• Added tests for sendOtp and verifyOtp to ensure they call getClientFetch with the correct parameters and headers.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

Summary by CodeRabbit

• Bug Fixes

  • Improved in-app wallet email and phone OTP requests by ensuring required SDK platform information is included.
  • Preserved optional ecosystem details during OTP authentication requests.

• Tests

  • Added coverage for sending and verifying OTPs, including request handling and optional ecosystem data.

[changeset-bot]

🦋 Changeset detected

Latest commit: df54ba2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
thirdweb	Patch
@thirdweb-dev/nebula	Patch
@thirdweb-dev/wagmi-adapter	Patch
wagmi-inapp	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@blockgroot is attempting to deploy a commit to the thirdweb Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 13cde47b-4157-4700-9d1c-753c477846ad

📥 Commits

Reviewing files that changed from the base of the PR and between 07fcec0 and df54ba2.

📒 Files selected for processing (3)

• .changeset/fix-otp-getclientfetch-bundle-id.md
• packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.test.ts
• packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.ts

---

Walkthrough

OTP email and phone requests now use getClientFetch for sending and verification. Tests cover client-fetch routing and ecosystem forwarding. A patch changeset documents the transport update.

Changes

OTP transport

Layer / File(s)	Summary
Route OTP requests through getClientFetch packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.ts, packages/thirdweb/src/wallets/in-app/web/lib/auth/otp.test.ts, .changeset/fix-otp-getclientfetch-bundle-id.md	sendOtp and verifyOtp use getClientFetch(client, ecosystem) and keep only the Content-Type request header. Tests verify client-fetch routing, successful responses, and ecosystem forwarding. The changeset documents the patch release.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to df54b

This localized change routes OTP requests through the shared client fetch path and adds focused tests; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: 0xfirekeeper

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the SDK fix and the change to route in-app wallet OTP login through getClientFetch.
Description check	✅ Passed	The description includes the issue reference, reviewer notes, implementation details, testing steps, and test results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}