Invalid
Exception thrown when a client_domain operation has an incorrect source account.
SEP-10 Security Requirement: If a "client_domain" ManageData operation is present, its source account MUST be the account that will sign on behalf of the client domain.
Client domain verification allows a client application (like a wallet) to prove ownership of its domain to the authentication server. This enables:
Server allowlists/denylists based on client application
Enhanced security through mutual authentication
Attribution of authentication requests to specific applications
The verification process:
Client requests challenge with clientDomain parameter
Server adds "client_domain" operation with source = client domain's signing key
Client fetches client domain's stellar.toml to get SIGNING_KEY
Client signs with both user's key AND client domain's key
Server verifies both signatures
This check ensures the source account matches the account the client will use for signing, preventing source account substitution attacks.
Parameters
The expected client domain signing account (from stellar.toml)
The actual source account found in the operation