Would it be feasible to contract access to a web resource based on whether the Metamask wallet connected to the web client owns an NFT of a certain kind?

For example, I have a video hosted somewhere, password-protected, and I can call an API on my video host to create a password for the video on the fly. And I would like to use that to control access to that video based on whether the wallet accessing the page owns an ERC721 token of a certain kind.

I was thinking of something like:

  • client sends wallet address to server
  • server checks ownership of token
  • if wallet owns token, server generates a session-specific password with a given expiration and sets it in a cookie or something like that to initiate a session
  • client can use that password to load the video
  • next time he comes back, we check the cookie, and if the cookie expired we restart the process, otherwise direct access

Is that possible? Is there an easier way to implement something like a Pay-per-view system like that? Are there attack vectors I'm not seeing?


Rather than just checking for an address, you may want to check for a valid signature and recover the address from that signature, so that the user can proof that they have access to the address. Otherwise anyone could simply send an address that has the NFT to your server.

  • Very good point
    – Sebastien
    Jan 17 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.