Skip to main content
This is an enterprise-only feature. Please contact us to enable.
This is the hosted form factor of Fireblocks Flow’s wallet connector, built on the Dynamic SDK. Instead of building a wallet picker yourself, you send users to a connect page with a catalog of 800+ external wallets (for example MetaMask or Phantom), plus manual address entry. For the choice between this and native connection, see Connections.
Dynamic hosts a ready-to-use instance at https://connect.dynamicauth.com/. Deploying your own instance on a custom domain is also supported, and is arranged as part of enabling the feature. See the live demo.

​
Redirect or headless

Redirect (basic)

Open the connect page with a redirect_uri. The user connects a wallet (or pastes an address) and it redirects back with the public address. Address-only: no signature or transaction.

Headless

iOS, Android, and Flutter. Render your own native wallet list backed by a hidden web view running the Dynamic SDK. After connecting, you can also sign messages and transactions over the same bridge. Your app links no wallet SDK.
Already building with the React, React Native, or JavaScript SDK? Use the SDK directly for full wallet state (balances, embedded wallets, signing APIs). See Wallets.

​
When to use this

Reach for it when you want a wallet address (and optionally signing) without adding the Dynamic SDK to every client:
  • You want a hosted picker. Link out to one page instead of building and maintaining a wallet list per platform.
  • You can’t add a third-party SDK. On iOS, Android, and Flutter, headless mode runs the wallet list and connection logic behind a hidden web view, so your app links no wallet SDK. After connect, you can also sign messages and transactions through that same bridge.

​
How it works

Every platform follows the same redirect contract for the basic flow:
1

Open the connect page

Open it with a redirect_uri you control, and an optional nonce. The platform guides under Implement show the URL assembly for each platform.
2

The user connects

The user searches Dynamic’s catalog of 800+ wallets, or pastes an address manually.
3

Read the result on your redirect

It redirects back to your redirect_uri with the result appended as query parameters:
Pick your platform for the full integration guide (including copy-paste harness sources):

Web

Link to the hosted page and read the result on your redirect.

iOS (basic)

Present it in ASWebAuthenticationSession.

iOS (headless)

Native list via a hidden web view. Connect and sign over the bridge.

Android (basic)

Present it in a Chrome Custom Tab.

Android (headless)

Native list via a hidden WebView. Connect and sign over the bridge.

React Native

Present it with expo-web-browser.

Flutter (basic)

Present it with flutter_web_auth_2.

Flutter (headless)

Native list + message signing and EVM, Solana, and Bitcoin sends, plus Bitcoin PSBT signing, via a hidden WebViewWidget.

​
Securing the redirect

redirect_uri is caller-supplied, so an http(s) target is an open-redirect surface. Lock it down before exposing this to untrusted callers.
Set NEXT_PUBLIC_CONNECT_ALLOWED_REDIRECT_HOSTS to the http(s) hosts you accept: bare hostnames, comma-separated, no scheme, no path, no wildcards. Left unset, any host is accepted (with a console warning) so existing integrations keep working.
  • Exact hostname match. example.com does not match sub.example.com. Port is ignored.
  • Rebuild to apply. Next.js inlines NEXT_PUBLIC_* variables at build time, so changing this needs a rebuild and redeploy. Setting it in a hosting dashboard alone does nothing.
  • Custom app schemes are never host-filtered. Their “host” is a callback name interpreted by your native app, not a network address.
A handful of schemes that can hand off to another app or a browser-internal page are always refused, even in permissive mode: javascript:, data:, intent:, android-app:, market:, content:, chrome:, ftp:, and similar. A refused value falls back to the same-origin /callback page and logs a warning. If your callback never fires, check the browser console first.
Last modified on September 21, 2026