Test with mobile

Use mobile approval and mobile signing with Gora app results — on the live testnet out of the box, or against a local dev bridge.

Test with mobile

Use mobile when a person needs to review, approve, or sign something produced by a Gora app.

Test against the live testnet

The iOS and Android apps ship preconfigured with the live bridge:

https://gora-bridge.74.241.248.103.nip.io

Nothing to set up: the wallet, GORA faucet, app directory, signing, and validator screens all target the live testnet out of the box. Endpoints and deployed contract IDs are listed in Connect to the testnet.

When an app deployed to the live node returns a mobile_signing_request, the node publishes it to the live bridge with POST /mobile/signing-requests. The mobile app reads the same inbox through GET /mobile/signing-requests and shows the pending request for review and signing.

Quick checks against the live bridge:

curl https://gora-bridge.74.241.248.103.nip.io/health
curl https://gora-bridge.74.241.248.103.nip.io/mobile/signing-requests

There are two related flows:

Flow	Meaning
Mobile approval	User approves or rejects an app action
Mobile signing	User signs a native chain payload or transaction

Neither flow gives Gora the user’s private key.

When to use mobile

Use mobile for:

• transfers
• wallet actions
• smart-wallet approvals
• gateway fulfillment signatures
• any result that moves value or changes chain state

For pure off-chain results, mobile is optional.

App output shape

A mobile-signing app can return:

{
  "type": "agent_mobile_signing",
  "schema_version": 1,
  "app_id": "my_agent",
  "chain": "base",
  "decision": "approve_native_transfer",
  "mobile_signing_request": {
    "schema_version": 1,
    "chain": "base",
    "kind": "native_transfer",
    "from": "user_wallet_address",
    "to": "recipient_wallet_address",
    "amount": "1000",
    "amount_unit": "wei",
    "human_summary": "Transfer 1000 wei on Base Devnet"
  }
}

The Gora node can fill missing request metadata such as request id, app id, and timestamps before publishing to a signing surface.

Local Dev Bridge (secondary path)

Use this only when you run your own local devnet instead of the live testnet.

During development, a bridge service may expose pending actions to the mobile app.

Gora result → pending mobile inbox → user approves/signs → signed response → submitter/gateway

The bridge is a development helper. It is not a replacement for contract checks.

gora devnet up starts the bridge by default and exposes it through your public tunnel (ngrok, Caddy, or any HTTPS tunnel works):

VM-local bridge: http://127.0.0.1:8787
Mobile URL:      https://YOUR-BRIDGE-URL

Gora publishes signing requests to the VM-local bridge URL. The mobile app, running on another computer, should point at your public bridge URL in the app settings instead of the preconfigured live bridge.

If you start gora node serve manually, configure a signing-request sink with:

gora node serve \
  --http 127.0.0.1:8080 \
  --signing-request-sink http://127.0.0.1:8787

Or set one of:

GORA_SIGNING_REQUEST_SINK_URL=http://127.0.0.1:8787
GORA_DEV_BRIDGE_URL=http://127.0.0.1:8787

What users should review

Mobile should show:

• app name and app id
• chain
• sender
• recipient
• amount and unit
• policy or package hash
• attestation/result hash when available
• risk notes

Users should reject anything unexpected.

Dev keys

For local devnet tests, import only dev-only keys:

• Base hex private key
• Solana JSON/base58/base64/hex keypair
• Algorand 25-word mnemonic or raw key format

See Devnet wallets and keys.

Never import production keys into a local test build.

After approval or signing

After mobile signs, the signed response still needs to be submitted or fulfilled.

Common submission modes:

Mode	What happens
mock	Devnet records a mock tx/proof for tests
evm_raw	Raw signed EVM tx is sent with eth_sendRawTransaction
solana_raw	Serialized Solana tx is submitted with sendTransaction
algorand_raw	Signed Algorand tx bytes are submitted to algod

Your contract or gateway should still verify:

• Gora result or attestation
• app id
• output hash
• user signature
• policy limits
• replay protection

Quick test flow (live testnet)

Only Algorand is live on the public testnet today, so use --chain algorand:

gora init mobile-test --template agent-mobile-signing --chain algorand --yes
cd mobile-test

gora config set node.url https://gora-bridge.74.241.248.103.nip.io
gora contract deploy --chain algorand --node https://gora-bridge.74.241.248.103.nip.io
gora contract link --chain algorand

gora build
gora validate
gora deploy
gora invoke --app mobile_test --input fixtures/request.json

Then open the mobile app, review the pending request, and sign with a testnet key. Treat all testnet keys and funds as disposable.

Next: Troubleshooting.