Permissions and Privacy

#Which sites can connect

• Allowed: https: sites, and http: only on localhost, 127.0.0.1 and [::1].
• Refused with 4100: file:, data:, blob:, about:, browser and extension pages, and sandboxed frames with an opaque (null) origin.

#What a connection grants

• Per site, per account. A grant is tied to your exact origin (scheme, host and port). The user chooses which accounts to share, and your site can only use those accounts.
• Embedded frames need their own approval. A cross-origin iframe can't use the top-level page's grant until the user approves it separately.
• Every signature is approved. Each signing request needs its own approval, which expires after 5 minutes (reported as 4001).

#Nothing is revealed before approval

Until the user approves your site:

• getAccounts() and a silent connect() return an empty list;
• your site receives no events;
• your site can't tell whether Joey is locked, because it gets 4001 where a connected site would get 4300, and connect waits for unlock rather than failing quickly.

The extension doesn't read page content and sends nothing about the pages a user visits.

#Changes while a request is pending

• If the user switches network, the request fails with 4901.
• If your site's access is revoked, the request fails with 4100.

#Revoking access

• By your dApp: call joey.disconnect().
• By the user: Settings → Connected Sites. Your site receives a disconnect event, and its pending requests are withdrawn.
• Deleting an account removes it from every grant. A site left with no accounts is disconnected.

#Rate limits

Exceeding these limits returns -32005. Back off rather than retrying in a loop.