solana-sign-with-payment

Motivation

Because as of writing it's still difficult for some people to sign a message in Solana, for example: phantom/sandbox#14

So we go back to basics -- just ask the user to send some fund.

How it works

The server will generate a (by default) 6 digit number that serves as some sort of OTP. The client can then send this amount of lamports to his/her own wallet within the challenge timeframe to prove ownership of the wallet. The server will issue an JWT that can then be passed to other services, just like how you would pass a signature that is obtained from e.g. Phantom wallet.

Note that this is intended to be used in an interactive setting. The signed JWT emitted by the server contains a prevSig which would be invalidated if the user does any other transaction in-between init and verify.

Quick Start

This repository is already deployed at https://solana-sign-with-payment.netlify.app. If you trust the author you can use it directly but there is no uptime guarantee. Alternatively you can deploy this repository directly as a netlify app and set the environment variables found in netlify/lib/env.ts

The only variable that really needs to be set is JWK_PRIVATE_KEY. You can generate one with a tool such as https://mkjwk.org/

Client

// 1. Request payment amount and destination
const resp = await (await fetch('https://solana-sign-with-payment.netlify.app/init', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ message: "hello, world!", from: window.solana.publicKey.toString() }),
})).json();

// 2. Make the payment
const { signature } = await window.solana.signAndSendTransaction(new Transaction().add(SystemProgram.transfer({
    fromPubkey: window.solana.publicKey,
    toPubkey: new PublicKey(resp.destination),
    lamports: resp.lamports
})));
await connection.confirmTransaction(signature);

// 3. Submit the payment signature (i.e. txid) for verification
const resp2 = await (await fetch('https://solana-sign-with-payment.netlify.app/verify', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ jwt: resp.jwt, sig: signature }),
})).json();

// 4. We get a JWT signed by the verification service
// Call your app with the resultant JWT
fetch(`https://your-app.com/next-step?jwt=${resp2.jwt}`)

Server

From the above example, your app server can verify the authenticity of the JWT by something like:

import * as jose from 'jose';
//...
const jwks = jose.createRemoteJWKSet(new URL('https://solana-sign-with-payment.netlify.app/.well-known/jwks.json'));

// 5. Verify the JWT using the verification service's public key
const { payload } = await jose.jwtVerify(payload.jwt, jwks);

// Finally!
// 6. Consume the signed message
console.log(payload.from);
console.log(payload.message);

Configuration

If you run your own deployment you can change this settings by environment variable:

Env	Description	Default
`JWK_PRIVATE_KEY`	Private key in JWK JSON format. Required
`SOLANA_API_URL`	`mainnet-beta`, `testnet`, `devnet`, or REST URL of your RPC	`mainnet-beta`
`PAYMENT_DESTINATION`	You can specify an address for user to send to. Leave blank for user to send SOL to back to himself
`JWT_ALGORITHM`	e.g. ES256, RS256	`ES256`
`JWT_EXPIRY`	JWT expiry in seconds, must `verify` within this timeframe	`600`
`MIN_LAMPORTS`	Minimum lamports that will be requested	`100000`
`MAX_LAMPORTS`	Maximum lamports that will be requested	`999999`

kizzx2/solana-sign-with-payment

solana-sign-with-payment

Motivation

How it works

Quick Start

Configuration