Mobile App Deeplink to Twitter is Broken

[trustlessmatt]

Summary

Twitter auth is currently pushing to web browser/safari instead of the app on mobile, which breaks the flow for anyone looking to use our web app on mobile to connect their twitter.

Solana Wallet Adapter packages:
"@solana/wallet-adapter-base": "^0.9.22",
"@solana/wallet-adapter-react": "^0.15.32",
"@solana/wallet-adapter-react-ui": "^0.9.31",
"@solana/wallet-adapter-wallets": "^0.19.18",

Example

https://degenpicks.xyz

Steps to Reproduce

1. (Optional) Visit example URL on mobile browser
2. (Optional) Click wallet button in top right (redirects to Phantom app browser)
3. Open example URL in Phantom app browser
4. Click User Icon next to wallet button
5. Sign message prompt pops up
6. Select "Approve"
7. Opens Twitter/X app successfully but approval is inside a Safari instance within the app
8. Click "Authorize App"
9. App never redirects back to Phantom browser with auth token

Phantom Version

23.11.0

Is there an existing discussion for this?

• I have searched the existing discussions

[adamdelphantom]

Thanks for writing in @mattdegods!

We are looking into this. Has this flow behaved differently for you before?

[adamdelphantom]

@mattdegods yep, for example: "native mobile browser" = safari on iOS.

Using strictly the phantom in-app browser on my iPhone, I was able to connect and sign in.

1. phantom browser: go to degenpicks.xyz
2. click wallet
3. connect phantom
4. hit user icon
5. signed the message in phantom
6. got routed to the x app and approved
7. I could then access "Degen Picks (classic)" w/ no games because the wallet I was using didn't have a NFT

so it appears that flow works.

What I'm asking is if you've tried using deep links for those that login using safari or chrome?

It would look something like this:

you'd likely need to separate the phantom sign and x authentication functions

1. from safari: user goes to degenpicks.xyz
2. user hits wallet connect button
3. w/ a deeplink user is routed to phantom and connects their wallet
4. user is sent back to safari: degenpicks
5. user hits button to sign a message
6. w/ another deep link user is rated to phantom, signs the message
7. user is sent back to safari: degenpicks
8. then user can auth via X

This UX is worse but it may be necessary if X is making it difficult for phantom to carry the X auth back to the native mobile browser

Here's some info on implementing deep links:
https://docs.phantom.app/phantom-deeplinks/deeplinks-ios-and-android
https://phantom.app/learn/blog/the-complete-guide-to-phantom-deeplinks

[bfriel]

It looks like there is a known issue with Twitter's mobile in-app browser that is preventing users from authenticating with their Twitter accounts on third-party sites: https://twittercommunity.com/t/web-oauth-2-0-is-broken-on-android-if-twitter-app-is-installed/169698/15

[trustlessmatt]

The flow you described is actually the issue.

• You were routed to the X app, hit approve, but then if you notice, the user icon is gone. This is because your wallet data did not pass through to the X app browser. So you're seeing it as a user not logged in. Anyone can see games, regardless of wallet status, and there's no NFT integration.
• What should happen is the wallet data needs to either pass through to X or the auth token needs to be able to come back to phantom browser.

[adamdelphantom]

@mattdegods I was able to authenticate w/ X in the in-app browser but it was a multi-step process.

1. connected in the in-app browser
2. hit the X link button
3. signed the message with the Phantom toast
4. was sent to X
5. signed in to X using my X credentials
6. went back to degenpicks
7. then I was able to link because I was already signed in to X in that browser session
8. Now I'm signed in and X is linked.

I think the issue is that you're signing a message and then sending the user to auth with X. I don't think we can in the same call return the signed message and then also return the X auth session. Have you tried separating these steps? Have the user Sign the message and THEN have them link X, instead of trying to do them with the same call.