chore: don't override auth token / client id when hitting in app wall…

.changeset/nervous-tips-pay.md

@@ -0,0 +1,5 @@
+---
+"thirdweb": patch
+---
+
+fix: allow account linking on thirdweb dashboard

packages/thirdweb/src/utils/fetch.ts

@@ -47,7 +47,7 @@
 
       // if we have an auth token set, use that (thirdweb.com/dashboard sets this for the user)
       // pay urls should never send the auth token, because we always want the "developer" to be the one making the request, not the "end user"
-      if (authToken && !isPayUrl(url)) {
+      if (authToken && !isPayUrl(url) && !isInAppWalletUrl(url)) {
         headers.set("authorization", `Bearer ${authToken}`);
       } else if (secretKey) {
         headers.set("x-secret-key", secretKey);
@@ -140,6 +140,19 @@
   }
 }
 
+function isInAppWalletUrl(url: string): boolean {
+  try {
+    const { hostname } = new URL(url);
+    // in app wallet service hostname always starts with "in-app-wallet." or "embedded-wallet."
+    return (
+      hostname.startsWith("in-app-wallet.") ||
+      hostname.startsWith("embedded-wallet.")
+    );
+  } catch {
+    return false;
+  }
+}
+
 const SDK_NAME = "unified-sdk";
 
 let previousPlatform: [string, string][] | undefined;