Solana Pay & Actions Best Practices
25 practices for safe, discoverable Pay and Actions flows.
//
Search across all documentation pages
25 practices for safe, discoverable Pay and Actions flows.
HTTPS everywhere: Actions, icons, and callbacks must use TLS (Security & Verification).
Implement OPTIONS CORS: Wallets preflight POST - missing OPTIONS breaks flows.
GET is metadata only: Never mutate state on GET action routes.
Simulate POST transactions: Return only sim-successful wire txs.
Verify payments server-side: Reference account + amount via RPC (Solana Pay Basics).
Unique reference per order: Prevent replay and reconciliation bugs.
bigint lamports: Consistent with kit 7.0.0 types.
Fresh blockhash per POST: No cached transactions.
Least-privilege instructions: Actions are high-risk phishing targets.
Self-host action icons: Avoid third-party hotlink tampering.
Rate limit POST endpoints: Prevent RPC griefing.
Tighten CORS in production: Wildcard only for dev.
Cluster clarity: Metadata or docs state devnet vs mainnet.
Human-readable labels: Wallet preview truncation is real.
Test on multiple wallets: Phantom, Solflare minimum.
Test Blink unfurl: Icon, title, and button before campaign launch.
Log signatures: Analytics and support for completed actions.
Never return secrets in JSON: Only base64 transactions.
Auth for sponsored actions: Cap per user/day.
Codama builders for program ixs: Avoid hand-encoded discriminators.
Monitor clone domains: Phishing copies your action UI.
Educate users to check domain: Blink literacy reduces drains.
Separate devnet endpoints: Env vars per deployment.
Document action intent: Public security page explaining tx effects.
Incident runbook: Pause action URL if exploit suspected.
Pay for simple transfers/QR; Actions for rich tx + Blinks.
Use supported unfurlers or direct action links in compatible apps.
Yes for encodeURL transfer requests alongside Actions.
Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.
Reviewed by Chris St. John·Last updated Jul 16, 2026