Restricting External Adapter Access to a Specific Smart Contract: Is it Feasible?

Question

How can I ensure that my external adapter is only accessible by a specific contract? Does the Post express middleware in the external adapter have a header key indicating the calling smart contract? I've considered embedding a key in the contract, but given the public nature of blockchain data, it seems impractical. Any suggestions?

Here is my javascript external adapter code:

app.post("/", (req, res) => {
  if (process.env.DEBUG === true) console.log("POST Data: ", req.body);
  // does the "req" object has some header or something to distinguish the smart contract caller ?
  createRequest(req.body, (status, result) => {
    if (process.env.DEBUG === true) console.log("Result: ", result);
    res.status(status).json(result);
  });
});

Answer 1

It seems like there may be some missing context, based on the tags "chainlink" and "chainlink-vrf," I going to assume you are utilizing Chainlink functions to call your endpoint. In this case, you can use an API key to authenticate. Here's a helpful tutorial that explains how to do so: https://docs.chain.link/chainlink-functions/tutorials/api-use-secrets.