recurr-public

Portal Page

Tenant-agnostic customer portal — connect wallet, see all subscriptions across every merchant who has billed that wallet.

Embeds zero JS framework. Wallets:

  • EVM (Base, Tempo, ...): MetaMask injected provider + EIP-191 personal_sign
  • Solana: window.solana (Phantom)
  • Algorand / VOI: Pera, Defly, Lute (signData with "MX" prefix)
  • Stellar: Stellar Wallets Kit (Freighter, Albedo, xBull, Lobstr, Hana, Rabet)
  • Hedera: Hedera Wallet Connect (HashPack, Blade, Kabila) via Reown

Security: pre-sale Comet third-pass review (2026-05-07, Task A) caught that the previous replace('"', "") sanitisation of the chain query parameter was insufficient — single quotes and semicolons fell through into a JS string literal under the legacy 'unsafe-inline' CSP applied to /recurr/portal, enabling reflected XSS via ?chain='; alert(1);//. Replaced with a strict allowlist. The wc_pid reflection is also tightened to a 32-char-hex regex even though it sources from settings.

get/recurr/portal

Request

  • Base URL: https://api.algovoi.co.uk (the document declares no server; this is the origin it was published from)
  • URL: https://api.algovoi.co.uk/recurr/portal
  • Auth: none declared

Query parameters

chainstring

Default chain for wallet-connect

Response

Successful Response

Changes

No recorded changes to this operation across all 1 revision of this API.