Calling onlyowner functions using owner's private key

Question

I need to call a function with onlyOwner modifier in my smart contract via web3.js. I want a user of my site to be able to send their information to a white list, but it sends the transaction from the owners account (I have access to the private keys).

Neither the user or the owner should need to access the website via metamask, and the owner would pay for the transaction gas.

What is the best way to achieve this proxy service? I would just need to send a signed transaction? I obviously don't want to expose private keys.

Answer 1

You need to implement a backend service that signs and submits the whitelisting transaction on behalf of the owner.

For example:

1. Modify your website to send POST /whitelist request with address to be whitelisted as payload.
2. In your backend application implement a handler for this /whitelist endpoint. Make sure only authorized users can call this endpoint.
3. From your backend application generate a transaction, sign it with owner's private key (stored safely on the server you control) and submit this transaction to Ethereum network (either by running your own node or by using an API like infura.io).