One thing that bites in practice with scoped wallet connections (NWC or anything like it): treat "connected" as a lease, not a marriage.
Receive-only scopes are the right default for most apps. If you only create invoices, don't ask for pay. The day a bug or a compromised session can drain the wallet, you will wish you had.
On the receive path, invoice mint is the fragile bit. Wallet backends wedge under auth timeouts, clock jumps, or a frozen host. If your app hangs forever on "create invoice", users think they paid into a black hole. Put a hard timeout on mint (a few seconds), surface a clear retry, and never leave a half-created pending payment that the UI still shows as waiting.
Also test revoke mid-session before you ship. Approve → use → revoke in the wallet → next API call must fail closed. I've seen integrations that cache the credential and keep accepting work for minutes after revoke.
Last: whose node identity is on the invoice matters for proofs (already raised above). Pair that with a heartbeat or poll on the app side so a dead connection doesn't look like a quiet wallet.
One thing that bites in practice with scoped wallet connections (NWC or anything like it): treat "connected" as a lease, not a marriage.
Receive-only scopes are the right default for most apps. If you only create invoices, don't ask for pay. The day a bug or a compromised session can drain the wallet, you will wish you had.
On the receive path, invoice mint is the fragile bit. Wallet backends wedge under auth timeouts, clock jumps, or a frozen host. If your app hangs forever on "create invoice", users think they paid into a black hole. Put a hard timeout on mint (a few seconds), surface a clear retry, and never leave a half-created pending payment that the UI still shows as waiting.
Also test revoke mid-session before you ship. Approve → use → revoke in the wallet → next API call must fail closed. I've seen integrations that cache the credential and keep accepting work for minutes after revoke.
Last: whose node identity is on the invoice matters for proofs (already raised above). Pair that with a heartbeat or poll on the app side so a dead connection doesn't look like a quiet wallet.