Is Solana Pay Reference Private?

Question

I am building a purchase flow that will require the user to activate their purchase after the fact, is Solana Pay's reference private enough to use as an "access key" that the user can activate later down the road or could someone just watch transactions on chain to our shop wallet and steal references?

I can fairly easily create our own access key internally and just assign it to a reference inside our database, but was moreso just curious about the privacy of the reference used in Solana Pay transactions.

Answer 1

Nope, the reference will be available on-chain and isn't private. The point of it is that it is an account on the transaction, so that the transaction can be looked up using it. So by design it's public once there's a transaction.

I think the more common way to achieve what you want would be to have the user connect their wallet to your app. When you generate the reference, store it in a database alongside their public key. Then when you want to check for the transaction, you can look up the reference for the connected wallet. And then use findReference and validateTransfer to confirm that they've made the expected transaction.