GhostLink documentation

GhostLink uses proofs for app sign-in and on-chain limits for pocket spending. Setup uses wallet-signed messages; restoring an identity requires signing again, and funding can require a wallet transaction. A proof-only app integration can receive an app ID without receiving the user's wallet address or identity secret.

The two modules

Identity is sign-in: your app asks for a claim ("controls a registered wallet", optionally "holding at least X of mint M"), and verifies the proof on your backend. Authentication also requires a signed, single-use server challenge, trusted roots and a current chain slot. Off-chain login requires no transaction.

Pocket is spending: a program-derived account, unique to your app, funded by the user. Your app submits intents — "spend at most X of A, receive at least Y of B" — and a solver fills them atomically. The pocket program checks the outcome inside the same transaction and reverts everything if the deal isn't met.

You can use off-chain Identity verification without opening a spending pocket.

What makes it safe

The SDK exposes no main-wallet signTransaction method. It cannot stop another page or wallet integration from asking the user to sign.
Proofs disclose a per-origin ID rather than a wallet address. Raw identity secrets, witness requests, deposits and other metadata can still link activity.
Fills are atomic and subject to the pocket's daily cap; priced outputs have an oracle floor, while unpriced outputs require a verified passkey session and a separate cap.
Direct withdrawals go home. Changing home or policy requires owner authorization and a 24-hour timelock; notifications require a configured watcher.

Pocket activity and deposits are public on-chain. Proofs reduce what an app must learn, but do not hide public transfers or protect a secret handed to that app. The SDK does not provide an isolated identity broker.

Where things run

Layer	What	Trust
Device	Secret, session keys, proving (1–3 s on a laptop; phones not yet measured)	The host app must protect secrets and keep proving local
Services	Indexer, relayer, solver, actions, watcher	Liveness and request privacy; off-chain verification trusts its root source, and funding trusts or validates the Actions transaction
Programs	registry · census · pocket	Enforce the deployed rules; upgrade authority removal is a future release gate

Ready? Start with the quickstart, or read how identity and proofs work under the hood.