Back to skills
SKILL.md
Base Account
ASecurityERC-4337 smart wallet integration — Sign in with Base, one-tap USDC payments, gas sponsorship via paymasters, sub accounts, and spend permissions across chains. Use when integrating Base Account, SIWB, Base Pay, or paymasters.
- 9 stars
- 0 votes
- 0 copies
- 0 views
- Added September 10, 2026
Works with
Security analysis
96/100- Installs packages at runtime which could introduce malicious dependencies
Pro scans all 11 files and shows the line behind each finding
npx -y skills add cyotee/indexedex --skill base-account --agent claude-codeAre you the author of Base Account?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/cyotee-base-account)---
name: base-account
description: ERC-4337 smart wallet integration — Sign in with Base, one-tap USDC payments, gas sponsorship via paymasters, sub accounts, and spend permissions across chains. Use when integrating Base Account, SIWB, Base Pay, or paymasters.
metadata:
expanded_from: base/base-skills (build-on-base/references/base-account/)
---
# Base Account
Full Base Account documentation is under `references/`. Start with the overview, then load the topic you need.
## Contents
- [overview.md](references/overview.md) — Base Account overview
- [authentication.md](references/authentication.md) — Sign in with Base
- [payments.md](references/payments.md) — Base Pay / USDC payments
- [capabilities.md](references/capabilities.md) — Account capabilities
- [sub-accounts.md](references/sub-accounts.md) — Sub accounts
- [subscriptions.md](references/subscriptions.md) — Subscriptions
- [prolinks.md](references/prolinks.md) — Prolinks
- [troubleshooting.md](references/troubleshooting.md) — Troubleshooting
## Overview
# Building with Base Account
Base Account is an ERC-4337 smart wallet providing universal sign-on, one-tap USDC payments, and multi-chain support (Base, Arbitrum, Optimism, Zora, Polygon, BNB, Avalanche, Lordchain, Ethereum Mainnet).
## Quick Start
```bash
npm install @base-org/account @base-org/account-ui
```
```typescript
import { createBaseAccountSDK } from '@base-org/account';
const sdk = createBaseAccountSDK({
appName: 'My App',
appLogoUrl: 'https://example.com/logo.png',
appChainIds: [8453], // Base Mainnet
});
const provider = sdk.getProvider();
```
## Feature References
Read the reference for the feature you're implementing:
| Feature | Reference | When to Read |
|---------|-----------|-------------|
| Sign in with Base | [authentication.md](authentication.md) | Wallet auth, SIWE, backend verification, SignInWithBaseButton, Wagmi/Privy setup |
| Base Pay | [payments.md](payments.md) | One-tap USDC payments, payerInfo, server-side verification, BasePayButton |
| Subscriptions | [subscriptions.md](subscriptions.md) | Recurring charges, spend permissions, CDP wallet setup, charge/revoke lifecycle |
| Sub Accounts | [sub-accounts.md](sub-accounts.md) | App-specific embedded wallets, key generation, funding |
| Capabilities | [capabilities.md](capabilities.md) | Batch transactions, gas sponsorship (paymasters), atomic execution, auxiliaryFunds, attribution |
| Prolinks | [prolinks.md](prolinks.md) | Shareable payment links, QR codes, encoded transaction URLs |
| Troubleshooting | [troubleshooting.md](troubleshooting.md) | Popup issues, gas usage, unsupported calls, migration, doc links |
## Critical Requirements
### Security
- **Track transaction IDs** to prevent replay attacks
- **Verify sender matches authenticated user** to prevent impersonation
- **Use a proxy** to protect Paymaster URLs from frontend exposure
- **Paymaster providers must be ERC-7677-compliant**
- **Never expose CDP credentials client-side** (subscription backend only)
### Popup Handling
- Generate nonces **before** user clicks "Sign in" to avoid popup blockers
- Use `Cross-Origin-Opener-Policy: same-origin-allow-popups`
- `same-origin` breaks the Base Account popup
### Base Pay
- Base Pay works independently from SIWB — no auth required for `pay()`
- `testnet` param in `getPaymentStatus()` must match `pay()` call
- Never disable actions based on onchain balance alone — check `auxiliaryFunds` capability
### Sub Accounts
- Call `wallet_addSubAccount` each session before use
- Ownership changes expected on new devices/browsers
- Only Coinbase Smart Wallet contracts supported for import
### Smart Wallets
- ERC-6492 wrapper enables signature verification before wallet deployment
- Viem's `verifyMessage`/`verifyTypedData` handle this automatically
## For Edge Cases and Latest API Changes
- **AI-optimized docs**: [docs.base.org/llms.txt](https://docs.base.org/llms.txt)
- **Full reference**: [docs.base.org/base-account](https://docs.base.org/base-account)
Files in this skill
- SKILL.md
- base-account.png
- catalog.json
- references/authentication.md
- references/capabilities.md
- references/overview.md
- references/payments.md
- references/prolinks.md
- references/sub-accounts.md
- references/subscriptions.md
- references/troubleshooting.md
Attribution
Comments
Loading comments…
Newsletter
Get the weekly list of safe new skills, and the ones we pulled.