Is this a sensible flow for verifying that an Ethereum account is controlled by the same person as a Twitter account?
- User logs in to my site with Twitter
- I get an auth token back from the Twitter API
- I perform a web3js transaction on the client in which I store the hashed auth token in the smart contract in a mapping of addresses to hashed tokens
- After the transaction has finished, I send the auth token and contract address to my backend API. The backend queries the blockchain and verifies that the mapping in the smart contract contains the right hashed token for the right address.
- Now I know the two are connected, I store the Twitter username and Ethereum address off-chain in a database.