Solana Pay & Actions Best Practices

25 practices for safe, discoverable Pay and Actions flows.

HTTPS everywhere: Actions, icons, and callbacks must use TLS (Security & Verification).
Implement OPTIONS CORS: Wallets preflight POST - missing OPTIONS breaks flows.
GET is metadata only: Never mutate state on GET action routes.
Simulate POST transactions: Return only sim-successful wire txs.
Verify payments server-side: Reference account + amount via RPC (Solana Pay Basics).
Unique reference per order: Prevent replay and reconciliation bugs.
bigint lamports: Consistent with kit 7.0.0 types.
Fresh blockhash per POST: No cached transactions.
Least-privilege instructions: Actions are high-risk phishing targets.
Self-host action icons: Avoid third-party hotlink tampering.
Rate limit POST endpoints: Prevent RPC griefing.
Tighten CORS in production: Wildcard only for dev.
Cluster clarity: Metadata or docs state devnet vs mainnet.
Human-readable labels: Wallet preview truncation is real.
Test on multiple wallets: Phantom, Solflare minimum.
Test Blink unfurl: Icon, title, and button before campaign launch.
Log signatures: Analytics and support for completed actions.
Never return secrets in JSON: Only base64 transactions.
Auth for sponsored actions: Cap per user/day.
Codama builders for program ixs: Avoid hand-encoded discriminators.
Monitor clone domains: Phishing copies your action UI.
Educate users to check domain: Blink literacy reduces drains.
Separate devnet endpoints: Env vars per deployment.
Document action intent: Public security page explaining tx effects.
Incident runbook: Pause action URL if exploit suspected.

FAQs

Solana Pay vs Actions?

Pay for simple transfers/QR; Actions for rich tx + Blinks.

Need Blink provider?

Use supported unfurlers or direct action links in compatible apps.

@solana/pay still?

Yes for encodeURL transfer requests alongside Actions.

Building an Action - implementation
Next.js API Routes - hosting
Wallet Integration Best Practices - signing UX

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.

Solana Pay & Actions Best Practices

25 practices for safe, discoverable Pay and Actions flows.

HTTPS everywhere: Actions, icons, and callbacks must use TLS (Security & Verification).

Implement OPTIONS CORS: Wallets preflight POST - missing OPTIONS breaks flows.

GET is metadata only: Never mutate state on GET action routes.

Simulate POST transactions: Return only sim-successful wire txs.

Verify payments server-side: Reference account + amount via RPC (Solana Pay Basics).

Unique reference per order: Prevent replay and reconciliation bugs.

bigint lamports: Consistent with kit 7.0.0 types.

Fresh blockhash per POST: No cached transactions.

Least-privilege instructions: Actions are high-risk phishing targets.

Self-host action icons: Avoid third-party hotlink tampering.

Rate limit POST endpoints: Prevent RPC griefing.

Tighten CORS in production: Wildcard only for dev.

Cluster clarity: Metadata or docs state devnet vs mainnet.

Human-readable labels: Wallet preview truncation is real.

Test on multiple wallets: Phantom, Solflare minimum.

Test Blink unfurl: Icon, title, and button before campaign launch.

Log signatures: Analytics and support for completed actions.

Never return secrets in JSON: Only base64 transactions.

Auth for sponsored actions: Cap per user/day.

Codama builders for program ixs: Avoid hand-encoded discriminators.

Monitor clone domains: Phishing copies your action UI.

Educate users to check domain: Blink literacy reduces drains.

Separate devnet endpoints: Env vars per deployment.

Document action intent: Public security page explaining tx effects.

Incident runbook: Pause action URL if exploit suspected.

Solana Pay & Actions Best Practices

FAQs

Related

Search Documentation

Solana Pay & Actions Best Practices

FAQs

Related