Base Dashboard: domain verification fails with generic error while /api/verify returns 200

[GoldenHomeProject]

Filing here because there is no open issue tracker for the dashboard — base/web is archived, the dashboard's Support link points to a Discord channel, and no support email is published. Please redirect me if there's a better venue.

Summary

In Base Dashboard → Add Domain, registering a domain fails every time with:

Something went wrong. Please contact support.

The interesting part: POST /api/verify returns 200 and echoes back the correct app ID. Verification succeeds server-side. The UI fails to handle the success and shows a generic error, so the domain is never registered and setup cannot be completed.

App ID: 6aa920b109ac89ef27559dc8 · Domain: charitybillionaire.com (happy to share account details privately.)

8 attempts over 5 days (Sept 18–23), including a full re-authentication with a fresh session.

Our side checks out

The meta tag is present in the served HTML — no JS required, no redirect, no bot challenge — and returns 200 to a normal UA, an empty UA, and a bot UA:

$ curl -s https://charitybillionaire.com/ | grep base:app_id
<meta name="base:app_id" content="6aa920b109ac89ef27559dc8" />

Your verifier agrees

Run from the dashboard origin, authenticated, same session:

await fetch("/api/verify", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    url: "https://charitybillionaire.com",
    appId: "6aa920b109ac89ef27559dc8",
  }),
  credentials: "include",
}).then(r => r.text());

200  {"appId":"6aa920b109ac89ef27559dc8"}

Captured in the network log, the UI's own Register submissions also return 200 — and the UI renders the error anyway. No follow-up request is made; the flow just ends there.

Three defects in /api/verify

1. Error responses are returned with HTTP 200.

{"url":"https://www.example-that-cannot-be-fetched.com","appId":"..."}
  →  200  {"error":"Failed to fetch URL"}

A failure delivered under a success status. Any client branching on res.ok treats it as success and then fails downstream on the missing appId — which is a very plausible source of this exact generic error. This should be a 4xx.

2. A bare domain causes an unhandled 500 with an empty body.

{"url":"charitybillionaire.com","appId":"..."}     →  500  (empty body)
{"domain":"charitybillionaire.com","appId":"..."}  →  500  (empty body)

Worth noting the input's own placeholder reads "Enter your app domain" — so the format the UI asks the user for is the one that crashes the endpoint.

3. The error doesn't say which URL was fetched. Echoing the resolved URL back would make this self-diagnosable in seconds instead of days.

Two smaller UX bugs found along the way

• The Register button goes inert after an error. Clicking it again fires no request at all; the input must be edited first. It reads as an unresponsive button.
• An expired session hangs the app forever. When the cbw-jtw JWT in localStorage expires, /apps/<id> sits on "Loading your apps…" indefinitely and fires zero API calls — no redirect to login, no error. Only dashboard.base.org/ root surfaces a Log In button. Ours had expired ~15h earlier and there was no way to tell from the UI.

You may not be seeing these

Throughout every session, exceptions.coinbase.com/sentry/api/.../envelope/ returned HTTP 503 on every POST. If that's where dashboard client errors go, none of this is reaching your error tracking.

(There's also a persistent minified React #418 hydration error on the page, which looks unrelated.)

Ask

1. Could someone verify charitybillionaire.com for app 6aa920b109ac89ef27559dc8 manually so we can proceed? We're blocked on this to claim a Builder Code.
2. Return real status codes and machine-readable errors instead of 200 {"error":...} and empty 500s.
3. Surface the endpoint's error text in the UI instead of "Something went wrong."

Happy to re-run any diagnostic — the site is live and open source, and the contract is verified on Basescan.