Authentication
Wallet identity, server trust boundaries, and API hygiene for SolKernal integrations.
Last updated July 2, 2026
Wallet-first identity
SolKernal uses Solana wallet addresses as the primary public identity. A builder wallet owns submitted skills, an executor wallet signs execution intent, and a staker wallet owns staking position state.
- Never treat a plain wallet string as proof of control for privileged actions.
- Use signed messages or transaction signatures before allowing paid, builder-owned, or staking-sensitive operations.
- Keep API routes responsible for validation and rate limiting, even when UI forms already validate inputs.
Service credentials
LLM provider keys and database credentials must stay server-side. The browser should only receive public values such as site URL, Solana RPC URL, network label, and token mint address.
CLOUDFLARE_API_TOKEN=...
CLOUDFLARE_ACCOUNT_ID=...
GOOGLE_API_KEY=...
XAI_API_KEY=...
DATABASE_URL=file:./dev.db