Best Practices

​

Overview

​

Security recommendations

1. Domain allowlisting: Always configure your allowed domains in CDP Portal
2. HTTPS only: Never use CDP wallets on non-HTTPS sites in production
3. Rate limiting: Implement rate limiting on your authentication endpoints
4. Session management: Use appropriate session timeouts for your use case

​

State management

1. Always check authentication state: Before starting any authentication flow, verify if the user is already signed in:
   const user = await getCurrentUser();
   if (user) {
     // User is already authenticated
     return;
   }
   
2. Implement sign out: Provide a clear way for users to sign out:
   import { signOut } from '@coinbase/cdp-core';
   
   // Sign out the current user
   await signOut();
   
   For React applications, use the AuthButton component which handles sign out automatically, or the useSignOut hook:
   import { useSignOut } from '@coinbase/cdp-hooks';
   
   function SignOutButton() {
     const { signOut } = useSignOut();
     return <button onClick={signOut}>Sign Out</button>;
   }
   
3. Avoid redundant verification: Don’t call verifyEmailOTP or verifySmsOTP when a user is already authenticated. This will result in an error and may leave your application in an inconsistent state.

​

User experience tips

1. Clear messaging: Explain why users need to verify their email
2. Error handling: Provide helpful error messages for common issues
3. Loading states: Show progress during authentication steps
4. Success feedback: Confirm when authentication is complete

​

Choosing the right approach

​

What to read next

• Authentication Methods: Learn about available authentication options
• Implementation Guide: Step-by-step authentication integration
• Session Management: Understand session lifecycle and token management
• Server-side validation: Validate user sessions on your backend
• Security Configuration: Configure domain allowlisting and security settings
• React Components: Ready-to-use UI components including AuthButton