Build Token-2022 confidential-transfer transactions

curl --request POST \
  --url https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "solanaAddress": "<string>",
  "mint": "<string>",
  "tokenAccount": "<string>",
  "lamportsPerByte": "<string>",
  "chainId": "<string>",
  "recentBlockhash": "<string>",
  "lastValidBlockHeight": "<string>",
  "derivationVersion": 2,
  "destinationTokenAccount": "<string>",
  "amount": "<string>",
  "decimals": 127,
  "auditorElgamalPubkey": "<string>",
  "feePayer": "<string>"
}
'

import requests

url = "https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer"

payload = {
    "solanaAddress": "<string>",
    "mint": "<string>",
    "tokenAccount": "<string>",
    "lamportsPerByte": "<string>",
    "chainId": "<string>",
    "recentBlockhash": "<string>",
    "lastValidBlockHeight": "<string>",
    "derivationVersion": 2,
    "destinationTokenAccount": "<string>",
    "amount": "<string>",
    "decimals": 127,
    "auditorElgamalPubkey": "<string>",
    "feePayer": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    solanaAddress: '<string>',
    mint: '<string>',
    tokenAccount: '<string>',
    lamportsPerByte: '<string>',
    chainId: '<string>',
    recentBlockhash: '<string>',
    lastValidBlockHeight: '<string>',
    derivationVersion: 2,
    destinationTokenAccount: '<string>',
    amount: '<string>',
    decimals: 127,
    auditorElgamalPubkey: '<string>',
    feePayer: '<string>'
  })
};

fetch('https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'solanaAddress' => '<string>',
    'mint' => '<string>',
    'tokenAccount' => '<string>',
    'lamportsPerByte' => '<string>',
    'chainId' => '<string>',
    'recentBlockhash' => '<string>',
    'lastValidBlockHeight' => '<string>',
    'derivationVersion' => 2,
    'destinationTokenAccount' => '<string>',
    'amount' => '<string>',
    'decimals' => 127,
    'auditorElgamalPubkey' => '<string>',
    'feePayer' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer"

	payload := strings.NewReader("{\n  \"solanaAddress\": \"<string>\",\n  \"mint\": \"<string>\",\n  \"tokenAccount\": \"<string>\",\n  \"lamportsPerByte\": \"<string>\",\n  \"chainId\": \"<string>\",\n  \"recentBlockhash\": \"<string>\",\n  \"lastValidBlockHeight\": \"<string>\",\n  \"derivationVersion\": 2,\n  \"destinationTokenAccount\": \"<string>\",\n  \"amount\": \"<string>\",\n  \"decimals\": 127,\n  \"auditorElgamalPubkey\": \"<string>\",\n  \"feePayer\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"solanaAddress\": \"<string>\",\n  \"mint\": \"<string>\",\n  \"tokenAccount\": \"<string>\",\n  \"lamportsPerByte\": \"<string>\",\n  \"chainId\": \"<string>\",\n  \"recentBlockhash\": \"<string>\",\n  \"lastValidBlockHeight\": \"<string>\",\n  \"derivationVersion\": 2,\n  \"destinationTokenAccount\": \"<string>\",\n  \"amount\": \"<string>\",\n  \"decimals\": 127,\n  \"auditorElgamalPubkey\": \"<string>\",\n  \"feePayer\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"solanaAddress\": \"<string>\",\n  \"mint\": \"<string>\",\n  \"tokenAccount\": \"<string>\",\n  \"lamportsPerByte\": \"<string>\",\n  \"chainId\": \"<string>\",\n  \"recentBlockhash\": \"<string>\",\n  \"lastValidBlockHeight\": \"<string>\",\n  \"derivationVersion\": 2,\n  \"destinationTokenAccount\": \"<string>\",\n  \"amount\": \"<string>\",\n  \"decimals\": 127,\n  \"auditorElgamalPubkey\": \"<string>\",\n  \"feePayer\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "serializedTransactions": [
    "<string>"
  ],
  "transactionsTag": "<string>"
}

{
  "error": "<string>",
  "code": "exchange_currency_unsupported"
}

{
  "error": "No jwt provided!"
}

{
  "error": "Access Forbidden",
  "code": "sanctions_blocked"
}

{
  "error": "Not Found",
  "code": "not_found"
}

{
  "error": "Internal Server Error"
}

Build Token-2022 confidential-transfer transactions

deprecated

Decrypts the wallet’s stored confidential seed inside the enclave, generates the zero-knowledge proofs the requested operation requires, builds the Token-2022 confidential-transfer instructions and returns the transactions unsigned (the wallet’s signature slot is zeroed) in broadcast order, plus a transactionsTag binding them. Signing is a separate step: submit the transactions and tag unchanged to POST /waas/{walletId}/signConfidentialTransactions, which co-signs inside caller-visible MPC rooms. The enclave is offline: the caller supplies the token accounts’ raw on-chain state (accountState, destinationAccountState), the cluster rent constant (lamportsPerByte) and a fresh recentBlockhash/lastValidBlockHeight. Confidential amounts are opaque on-chain — policy screens the operation, mint and addresses but cannot evaluate the transferred amount.

POST

sdk

{environmentId}

waas

{walletId}

signConfidentialTransfer

Build Token-2022 confidential-transfer transactions

curl --request POST \
  --url https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "solanaAddress": "<string>",
  "mint": "<string>",
  "tokenAccount": "<string>",
  "lamportsPerByte": "<string>",
  "chainId": "<string>",
  "recentBlockhash": "<string>",
  "lastValidBlockHeight": "<string>",
  "derivationVersion": 2,
  "destinationTokenAccount": "<string>",
  "amount": "<string>",
  "decimals": 127,
  "auditorElgamalPubkey": "<string>",
  "feePayer": "<string>"
}
'

import requests

url = "https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer"

payload = {
    "solanaAddress": "<string>",
    "mint": "<string>",
    "tokenAccount": "<string>",
    "lamportsPerByte": "<string>",
    "chainId": "<string>",
    "recentBlockhash": "<string>",
    "lastValidBlockHeight": "<string>",
    "derivationVersion": 2,
    "destinationTokenAccount": "<string>",
    "amount": "<string>",
    "decimals": 127,
    "auditorElgamalPubkey": "<string>",
    "feePayer": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    solanaAddress: '<string>',
    mint: '<string>',
    tokenAccount: '<string>',
    lamportsPerByte: '<string>',
    chainId: '<string>',
    recentBlockhash: '<string>',
    lastValidBlockHeight: '<string>',
    derivationVersion: 2,
    destinationTokenAccount: '<string>',
    amount: '<string>',
    decimals: 127,
    auditorElgamalPubkey: '<string>',
    feePayer: '<string>'
  })
};

fetch('https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'solanaAddress' => '<string>',
    'mint' => '<string>',
    'tokenAccount' => '<string>',
    'lamportsPerByte' => '<string>',
    'chainId' => '<string>',
    'recentBlockhash' => '<string>',
    'lastValidBlockHeight' => '<string>',
    'derivationVersion' => 2,
    'destinationTokenAccount' => '<string>',
    'amount' => '<string>',
    'decimals' => 127,
    'auditorElgamalPubkey' => '<string>',
    'feePayer' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer"

	payload := strings.NewReader("{\n  \"solanaAddress\": \"<string>\",\n  \"mint\": \"<string>\",\n  \"tokenAccount\": \"<string>\",\n  \"lamportsPerByte\": \"<string>\",\n  \"chainId\": \"<string>\",\n  \"recentBlockhash\": \"<string>\",\n  \"lastValidBlockHeight\": \"<string>\",\n  \"derivationVersion\": 2,\n  \"destinationTokenAccount\": \"<string>\",\n  \"amount\": \"<string>\",\n  \"decimals\": 127,\n  \"auditorElgamalPubkey\": \"<string>\",\n  \"feePayer\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"solanaAddress\": \"<string>\",\n  \"mint\": \"<string>\",\n  \"tokenAccount\": \"<string>\",\n  \"lamportsPerByte\": \"<string>\",\n  \"chainId\": \"<string>\",\n  \"recentBlockhash\": \"<string>\",\n  \"lastValidBlockHeight\": \"<string>\",\n  \"derivationVersion\": 2,\n  \"destinationTokenAccount\": \"<string>\",\n  \"amount\": \"<string>\",\n  \"decimals\": 127,\n  \"auditorElgamalPubkey\": \"<string>\",\n  \"feePayer\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.dynamicauth.com/api/v0/sdk/{environmentId}/waas/{walletId}/signConfidentialTransfer")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"solanaAddress\": \"<string>\",\n  \"mint\": \"<string>\",\n  \"tokenAccount\": \"<string>\",\n  \"lamportsPerByte\": \"<string>\",\n  \"chainId\": \"<string>\",\n  \"recentBlockhash\": \"<string>\",\n  \"lastValidBlockHeight\": \"<string>\",\n  \"derivationVersion\": 2,\n  \"destinationTokenAccount\": \"<string>\",\n  \"amount\": \"<string>\",\n  \"decimals\": 127,\n  \"auditorElgamalPubkey\": \"<string>\",\n  \"feePayer\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "serializedTransactions": [
    "<string>"
  ],
  "transactionsTag": "<string>"
}

{
  "error": "<string>",
  "code": "exchange_currency_unsupported"
}

{
  "error": "No jwt provided!"
}

{
  "error": "Access Forbidden",
  "code": "sanctions_blocked"
}

{
  "error": "Not Found",
  "code": "not_found"
}

{
  "error": "Internal Server Error"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

environmentId

string

required

ID of the environment

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

walletId

string

required

UUID of the wallet

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

Body

application/json

solanaAddress

string

required

Solana address (base58 public key) whose confidential seed signs the operation. The seed must already exist (see POST /waas/{walletId}/confidentialSeed).

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$

operation

enum<string>

required

The Token-2022 confidential-transfer operation to build and sign.

Available options:

configureAccount,

deposit,

transfer,

applyPendingBalance,

withdraw

mint

string

required

The Token-2022 mint.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$

tokenAccount

string

required

The source confidential-capable token account.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$

lamportsPerByte

string

required

Current cluster rent constant in lamports per byte (e.g. 6333), used to compute rent exemption for the proof accounts. This is the per-byte rate, not the per-account total returned by getMinimumBalanceForRentExemption.

Pattern: ^[0-9]+$

chainId

string

required

SVM cluster identifier (genesis hash), binding the transaction to one cluster.

recentBlockhash

string

required

A recent blockhash (or durable-nonce value) fetched moments before invoking, since the enclave is offline and cannot reach Solana RPC.

lastValidBlockHeight

string

required

The last valid block height paired with recentBlockhash.

Pattern: ^[0-9]+$

derivationVersion

integer

Version of the stored seed to sign with. Defaults to the newest stored version; must match the version active on the confidential token account.

Required range: x >= 1

destinationTokenAccount

string

Required for transfer: the recipient's confidential-capable token account for the same mint.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$

amount

string

Required for deposit, transfer and withdraw: the token amount in base units, decimal-encoded (u64).

Pattern: ^[0-9]+$

decimals

integer

The mint's decimals, required for deposit and withdraw. Read from the mint account by the caller.

Required range: 0 <= x <= 255

auditorElgamalPubkey

string

The mint's confidential-transfer auditor ElGamal public key, when configured. Read from the mint account by the caller; omit when the mint has no auditor.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$

feePayer

string

The account that pays transaction fees. Defaults to solanaAddress.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$

accountState

object

Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.

Show child attributes

destinationAccountState

object

Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.

Show child attributes

Response

Unsigned transactions and their binding tag, ready for the sign step

serializedTransactions

string[]

required

Base64-encoded v1 transaction carrying the operation with its ZK proofs inlined. The wallet's signature slot is zeroed; sign it through POST /waas/{walletId}/signConfidentialTransactions.

Required array length: 1 element

transactionsTag

string

required

Enclave-issued authentication tag binding the wallet, operation, mint, token accounts, amount and the hash of every emitted message, with a short expiry. Submit it unchanged with serializedTransactions to POST /waas/{walletId}/signConfidentialTransactions.

Overview

Endpoints

Schemas

Build Token-2022 confidential-transfer transactions

Authorizations

Path Parameters

Body

Response