To use Phantom Connect in development and production, you must configure allowed origins and redirect URLs in Phantom Portal. These settings tell Phantom where your app is allowed to run and where users can be redirected after authentication.
Both are required to connect users.
Allowed origins
Allowed origins define where your app is allowed to initiate a connection from. Phantom will only connect if the request comes from one of these domains. This prevents other websites from impersonating your app.
Add allowed origins
- In Phantom Portal, expand your app in the left navigation and select Set Up.
- Scroll to Allowed Origins.
- Enter a domain where your app runs.
- Select Add.
Allowed origin requirements
- Include the protocol (
https:// for production).
- Use exact domains only.
- Do not include paths, query strings, or wildcards.
Examples
| Environment | Example |
|---|
| Production | https://yourapp.com |
| Staging | https://staging.yourapp.com |
| Local development | http://localhost:3000 |
Redirect URLs
Redirect URLs define where users are sent after authentication. These are required for social login flows (Google, Apple) and for completing the Phantom Connect handshake.
Redirect URLs can be web URLs or mobile app URIs.
Add redirect URLs
- In Phantom Portal, expand your app in the left navigation and select Set Up.
- Scroll to Redirect URLs.
- Enter a valid redirect URL.
- Select Add.
Redirect URL requirements
- Must exactly match the URL used in your app.
- Must be added and allowlisted in Phantom Portal before you can use it in production.
- Multiple redirect URLs are allowed.
Examples
| Use case | Example |
|---|
| Web app | https://yourapp.com/auth/callback |
| Local development | http://localhost:3000/auth/callback |
| Mobile app | myapp://phantom-auth-callback |
When using Google or Apple login, users are redirected to one of these URLs after authentication. If the redirect URL is missing or mismatched, login will fail.
Common setup mistakes
- Adding a redirect URL but forgetting to add the corresponding allowed origin.
- Including paths or wildcards in allowed origins.
- Using a redirect URL in code that hasn’t been added to Phantom Portal.
- Using
http:// for production domains.
Need help?
Contact Phantom developer support.
Next steps
