NFT ACCESS GUIDE
Protect the API route, not just the button.
NFT gating becomes real authorization only when the backend that controls the resource verifies ownership before granting access.
POLICY
Define the ERC-721 requirement once
Create a policy for the collection contract and the minimum ownership balance your feature requires.
VERIFY
Send the authenticated wallet from your backend
The protected route calls AccessVerdict with the wallet and policy ID before returning the resource.
const result = await accessVerdict.verify({ policyId, wallet });
if (!result.allowed) return new Response("Forbidden", { status: 403 });SECURITY
Keep the project API key out of browser code
Wallet connection can happen in the client. Authorization credentials and the final access decision stay on the server.