Authentication at CryPrice

This page documents how account access works for the Flutter Web dashboard at app.cryprice.dev. It describes the production Web flow implemented in the CryPrice frontend and backend — not wallet connection.

Why account access is required

CryPrice uses authenticated sessions so users can access portfolio data, public address configuration, and alert settings tied to their account. Per the project security model, portfolio data and wallet configuration require authenticated sessions; the API uses bearer token authentication (JWT) for protected routes.

Google OAuth is used solely for authentication into CryPrice and is not related to blockchain wallet access. The public API identity at GET https://api.cryprice.dev/ states readOnly: true and links to cryprice.dev/security for the full model.

Official domains

Domain	Role
cryprice.dev	Product website and trust pages (privacy, terms, security, trust, transparency, contact), and documentation links referenced by the API.
app.cryprice.dev	Flutter Web dashboard — the authenticated product surface (this application).
api.cryprice.dev	REST API for portfolio, auth, and read-only DeFi risk data. `GET /` returns a public identity JSON payload.

Flutter Web account access (production)

On Web, the Flutter app navigates to the backend OAuth start URL built by buildGoogleOAuthStartUrl in the frontend. Production Web login uses GET /auth/google/oauth/start — not the legacy GIS redirect start path.

Browser opens GET https://api.cryprice.dev/auth/google/oauth/start?return_to=<app-url>. The backend validates return_to, stores OAuth state, and redirects to Google.
After Google consent, the browser returns to GET https://api.cryprice.dev/auth/google/oauth/callback?code=...&state=.... The backend validates the state cookie, exchanges the authorization code, verifies the Google ID token, and creates a CryPrice session.
The backend redirects to return_to with a one-time query parameter gis_exchange=<code>. Session tokens are not placed in the redirect URL.
The Flutter app calls POST https://api.cryprice.dev/auth/google/exchange with { "code": "<gis_exchange>" } and receives accessToken, refreshToken, and user — the same payload shape as POST /auth/google.
Tokens are stored client-side via flutter_secure_storage. Subsequent API calls use Authorization: Bearer <accessToken>.

Native mobile builds use POST /auth/google with a Google ID token directly; that path is separate from the Web OAuth redirect flow above.

API routes involved in login

Public auth routes (no bearer token required) include:

GET /auth/google/oauth/start
GET /auth/google/oauth/callback
POST /auth/google/exchange
POST /auth/google (native / legacy ID token path)
POST /auth/refresh

After sign-in, protected routes include GET /auth/me and POST /auth/logout.

What you can do after sign-in

Implemented features in the Flutter Web app include:

Multi-wallet portfolio dashboard across supported networks
DeFi supplied and borrowed positions (primary implemented protocol: Aave V3)
Aave V3 Health Factor display via the portfolio API
Protocol and wallet filters; allocation charts from backend-provided series
PDF portfolio export (backend-generated)
Profile and public address management (add, edit label, remove)
Optional Telegram account linking from the profile for notifications
Price Calculator (CEX/DEX quotes from the backend)

Supported networks in the backend configuration include Ethereum, Arbitrum, Avalanche, and Base.

What CryPrice does not request

CryPrice is designed as a read-only platform.

The platform does not require users to provide:

recovery phrases (seed phrases);
private keys;
wallet signing credentials.

CryPrice does not execute blockchain transactions and does not take custody of user assets.

Authentication through Google OAuth is used only for CryPrice accounts and is unrelated to blockchain wallet authentication. CryPrice does not require users to connect a wallet in order to monitor public blockchain addresses.

The public API identity documents a minimal trust surface:

readOnly: true
security.publicAddressesOnly: true
security.monitoringOnly: true
links to https://cryprice.dev/security for the full security model

Users add public addresses they want to monitor. The app does not integrate WalletConnect or similar wallet provider packages; authentication uses Google Sign-In via the backend, and addresses are entered as public EVM addresses (expected length 42 symbols, starting with 0x).

Trust & transparency

Project trust documentation lives on the marketing site (not inside the Flutter app):

Trust hub — read-only architecture, disclosure, contacts
Transparency — project stage, founder, funding context
Security model
security.txt — [email protected]

Why there is no WalletConnect

CryPrice is a read-only monitoring dashboard, not a wallet. The Flutter app authenticates with Google through the backend API and lets users add public blockchain addresses manually. There is no WalletConnect or web3 wallet dependency in the frontend package configuration.