2

I am building a purchase flow that will require the user to activate their purchase after the fact, is Solana Pay's reference private enough to use as an "access key" that the user can activate later down the road or could someone just watch transactions on chain to our shop wallet and steal references?

I can fairly easily create our own access key internally and just assign it to a reference inside our database, but was moreso just curious about the privacy of the reference used in Solana Pay transactions.

1
  • please edit this question to clarify that by "secure" you mean "private"
    – trent.sol
    Jul 19, 2022 at 19:12

1 Answer 1

4

Nope, the reference will be available on-chain and isn't private. The point of it is that it is an account on the transaction, so that the transaction can be looked up using it. So by design it's public once there's a transaction.

I think the more common way to achieve what you want would be to have the user connect their wallet to your app. When you generate the reference, store it in a database alongside their public key. Then when you want to check for the transaction, you can look up the reference for the connected wallet. And then use findReference and validateTransfer to confirm that they've made the expected transaction.

1
  • 1
    Thanks, that is what I figured just wanted to confirm.
    – Lockpick
    Jul 19, 2022 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.