How can I ensure that my external adapter is only accessible by a specific contract? Does the Post express middleware in the external adapter have a header key indicating the calling smart contract? I've considered embedding a key in the contract, but given the public nature of blockchain data, it seems impractical. Any suggestions?

Here is my javascript external adapter code:

app.post("/", (req, res) => {
  if (process.env.DEBUG === true) console.log("POST Data: ", req.body);
  // does the "req" object has some header or something to distinguish the smart contract caller ?
  createRequest(req.body, (status, result) => {
    if (process.env.DEBUG === true) console.log("Result: ", result);

1 Answer 1


It seems like there may be some missing context, based on the tags "chainlink" and "chainlink-vrf," I going to assume you are utilizing Chainlink functions to call your endpoint. In this case, you can use an API key to authenticate. Here's a helpful tutorial that explains how to do so: https://docs.chain.link/chainlink-functions/tutorials/api-use-secrets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.