Skip to content

fix(examples): unlock session with OTP before submitting withdrawal #9266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alia-bitgo wants to merge 1 commit into
base: master
Choose a base branch
from
+17 −6
Open

fix(examples): unlock session with OTP before submitting withdrawal #9266

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 17 additions & 6 deletions examples/ts/go-account/go-account-withdrawal.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,10 +51,10 @@ const walletId = process.env.OFC_WALLET_ID || 'your_wallet_id';
const walletPassphrase = process.env.OFC_WALLET_PASSPHRASE || 'your_wallet_passphrase';

/**
* Withdrawal destination address.
* For OFC wallets this is typically a BitGo address or counterparty address.
* Withdrawal destination — either a BitGo address or another Go Account wallet ID.
* Internal OFC transfers between same-jurisdiction Go Accounts accept a wallet ID directly.
*/
const recipientAddress = process.env.RECIPIENT_ADDRESS || 'your_recipient_address';
const recipientAddress = process.env.RECIPIENT_ADDRESS || 'your_recipient_address_or_wallet_id';

/**
* Amount to withdraw, in the base unit of the token being sent.
Expand All @@ -70,7 +70,7 @@ const withdrawalAmount = process.env.WITHDRAWAL_AMOUNT || '1000000'; // e.g. 1.0
* Note: For OFC wallets, the token name embedded in the recipient address usually
* determines which token moves — check BitGo docs for your specific flow.
*/
const token: string | undefined = 'ofctsol';
const token: string | undefined = 'ofctbtc4';

// ---------------------------------------------------------------------------

Expand Down Expand Up @@ -155,13 +155,24 @@ async function main() {
console.log(`Payload: ${payload}`);

// -------------------------------------------------------------------------
// Step 3: Submit the half-signed transaction to BitGo
// Step 3: Unlock the session, then submit the half-signed transaction
//
// BitGo requires an unlocked session (OTP) before accepting a send request.
// Set OFC_OTP in your environment (or .env) to your current TOTP code.
//
// The 'halfSigned' object carries the payload + signature. BitGo will
// validate the signature against the registered public key and, if valid,
// co-sign and broadcast the transaction.
// -------------------------------------------------------------------------
console.log('\nSubmitting signed transaction to BitGo...');
const otp = process.env.OFC_OTP;
if (!otp) {
throw new Error('OFC_OTP is required to unlock the session before submitting. Set it to your current TOTP code.');
}
console.log('\nUnlocking session...');
await bitgo.unlock({ otp });
console.log('✓ Session unlocked\n');

console.log('Submitting signed transaction to BitGo...');
// wallet.submitTransaction() runs the body through an io-ts codec (TxSendBody)
// that strips unknown fields — including `payload` — from halfSigned before
// sending. For OFC the server needs both fields, so call the endpoint directly.
Expand Down