I have users coming to my frontend, connecting with their wallet, and authenticating with Twitter (using OAuth). The next step is to let them mint an NFT with their Twitter name (extracted on the fly using Twitter API) and transfer it to their wallet.
The problem that I see is that, potentially, someone can just go to the smart contract and mint themselves a twitter name NFT without passing through the OAuth on the front end.
I guess the solution would be to:
- Allow only myself (aka the contract deployer) to mint NFT
- When a user does the OAuth, I mint an NFT adding his/her twitter name as metadata and adding some requirement like can only be transferred to 0xuseraddress
- The user can claim the NFT on the frontend by calling the transfer function.
What is the standard procedure in cases like this?
