JavaScript Fiber RPC SDK
Trusted appcommandsKnown node
- The app selects the endpoint and transport
- The app may hold node credentials
- The API mirrors broad node operations
node.sendPayment({ invoice }) A permissioned browser interface for Nervos Fiber
Websites request.
Users stay in control.
Fiber moves value. Fiber WebLN defines how an untrusted web page may ask a user's wallet to move it—without receiving private keys, node credentials, or unrestricted RPC access.
const fiber = await requestProvider();
// This is a request to the user—not a command
// sent directly to an exposed node.
const result = await fiber.sendPayment(invoice);
// The provider owns permission, confirmation,
// credentials and node execution.Fiber moves the money.
Fiber WebLN governs how the web asks.The page never gets the keys.01 / WHY A PROTOCOLNot another RPC SDK.
Not another RPC SDK.
A different trust model.
An RPC SDK helps trusted software command a known node. Fiber WebLN lets an untrusted page request narrowly defined capabilities from a user-controlled provider.
Fiber WebLN
Untrusted pagerequestsUser provider
- The user chooses where the Fiber node runs
- The page receives no endpoint or credentials
- The provider approves a safe capability surface
fiber.sendPayment(invoice)THE DIFFERENCE
RPC SDKs wrap node calls. Fiber WebLN standardizes the trust boundary between a web page and a user's wallet.
02 / TRUST BOUNDARYThe API is the door.
The API is the door.
The provider is the lock.
window.ckbfiber contains no node and no keys. The extension separates page code from authority, applies policy, and only then reaches a provider.
UNTRUSTEDWeb page
→window.ckbfiberNO KEYSPage facade
→postMessageISOLATEDOrigin bridge
→content scriptAUTHORITYPolicy gate
→permission · confirmEXECUTIONFiber provider
WASM or fnnONE PAYMENT REQUEST
What actually happens after a click
The site can initiate this sequence. It cannot skip a step.
- 01Request
The page calls sendPayment(invoice).
- 02Identify
The isolated bridge attaches the page origin.
- 03Authorize
The background gate checks the site's session.
- 04Confirm
The extension shows origin, amount and invoice.
- 05Execute
Only approval reaches the selected Fiber node.
03 / PROVIDER CHOICEOne browser contract.
One browser contract.
Two node models.
The same dApp can move between a browser-embedded Fiber node and a remote fnn process. Custody and transport change; application calls do not.
WASM node
fiber-js runs inside the extension's offscreen environment. Node execution and key material stay outside the page.
fnn over RPC
The extension talks to a configured fnn process. The page still receives neither its endpoint nor its credentials.
04 / SECURITY STATUSA real boundary.
A real boundary.
Still experimental.
The project demonstrates real Fiber calls and a working permission flow. It is testnet-first and is not yet a production wallet security claim.
- Per-origin connection approval
- Explicit method allowlist
- Per-action confirmation for value movement
- Keys and node objects isolated from the page
- Hardware-backed key derivation and recovery
- Permission expiry, revocation and spending limits
- Stricter schemas and origin validation
- Independent security review
Apps request.
Providers enforce.
Explore the typed contract or switch between both live provider implementations.