diff --git a/package-lock.json b/package-lock.json
index 9ec68b83..3f2c815b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,6 @@
       "dependencies": {
         "@ethereumjs/util": "^9.1.0",
         "@toruslabs/constants": "^14.0.0",
-        "@toruslabs/eccrypto": "^5.0.4",
         "@toruslabs/ffjavascript": "^4.0.0",
         "@toruslabs/metadata-helpers": "^6.0.0",
         "@toruslabs/secure-pub-sub": "^1.0.0",
@@ -23,7 +22,6 @@
         "bn.js": "^5.2.1",
         "bowser": "^2.11.0",
         "color": "^4.2.3",
-        "elliptic": "^6.5.7",
         "enc-utils": "^3.0.0",
         "end-of-stream": "^1.4.4",
         "events": "^3.3.0",
diff --git a/package.json b/package.json
index 044c303d..18652fd7 100644
--- a/package.json
+++ b/package.json
@@ -118,7 +118,6 @@
   "dependencies": {
     "@ethereumjs/util": "^9.1.0",
     "@toruslabs/constants": "^14.0.0",
-    "@toruslabs/eccrypto": "^5.0.4",
     "@toruslabs/ffjavascript": "^4.0.0",
     "@toruslabs/metadata-helpers": "^6.0.0",
     "@toruslabs/secure-pub-sub": "^1.0.0",
@@ -130,7 +129,6 @@
     "bn.js": "^5.2.1",
     "bowser": "^2.11.0",
     "color": "^4.2.3",
-    "elliptic": "^6.5.7",
     "enc-utils": "^3.0.0",
     "end-of-stream": "^1.4.4",
     "events": "^3.3.0",
diff --git a/src/core/utils.ts b/src/core/utils.ts
index decfa8b0..3b9dab25 100644
--- a/src/core/utils.ts
+++ b/src/core/utils.ts
@@ -1,20 +1,11 @@
-import { getPublic, sign } from "@toruslabs/eccrypto";
-import { keccak256 } from "@toruslabs/metadata-helpers";
 import bowser from "bowser";
 
-import { base64url, LOGIN_PROVIDER, safeatob } from "../utils";
+import { LOGIN_PROVIDER, safeatob } from "../utils";
 import { loglevel as log } from "./logger";
 
 // don't use destructuring for process.env cause it messes up webpack env plugin
 export const version = process.env.AUTH_VERSION;
 
-export async function whitelistUrl(clientId: string, appKey: string, origin: string): Promise<string> {
-  const appKeyBuf = Buffer.from(appKey.padStart(64, "0"), "hex");
-  if (base64url.encode(getPublic(appKeyBuf)) !== clientId) throw new Error("appKey mismatch");
-  const sig = await sign(appKeyBuf, keccak256(Buffer.from(origin, "utf8")));
-  return base64url.encode(sig);
-}
-
 export type HashQueryParamResult = {
   sessionId?: string;
   sessionNamespace?: string;