@money-sdk/core

Drop embedded wallet SDK. Creates an invisible iframe pointing at the Drop wallet and exposes per-chain web3 providers over a postMessage transport.

Usage

import { createWallet } from '@money-sdk/core'

const wallet = createWallet({
  walletUrl: 'https://dropwallet.app',
  signerUrl: 'https://account.moneyos.network',
  appId: '<YOUR_APP_ID>',
  providers: {
    solana: true,
    ethereum: true,
  },
})

const solana = await wallet.getProvider('solana')
await solana?.connect()

wallet.renderWidget(element) attaches the iframe to a DOM element so the user sees the wallet UI; pass null to detach it back into document.body.

wallet.setWidgetConfig({ theme, size, shape, compact }) forwards a widget configuration to the embedded wallet.

wallet.disconnect() forwards a wallet:disconnect message to the iframe.

See @money-sdk/react for React bindings.

Getting an appId

appId is a UUID the Drop wallet uses to look up per-partner configuration at the edge (allowed parent origins, extra chains to enable, feature flags). The partner database lives in apps/web/shared/partners.ts and is enforced by the Vercel Edge Function at apps/web/_api/embed.ts:

• The edge function sets Content-Security-Policy: frame-ancestors based on the partner's registered domains. Embedding the wallet from an unregistered origin triggers a browser-level CSP violation.
• The edge function injects window.__APP_CONFIG__ into the wallet HTML so the wallet app can scope storage / analytics / feature flags per-partner.

There is no self-service portal today — to register a new appId, open a PR against apps/web/shared/partners.ts with your entry. appId is optional during local development: you can omit it or pass any UUID and the wallet will fall back to NO_APP_CONFIG with a localhost-only CSP.

See the Developers documentation for the end-user-facing version of this guide.

License

MIT © Drop