Skip to content
monstera®
Explore
Start building
Reference

Security checklist

Operational controls required around confidential key storage and programmable authentication.

Application controls

  • Deploy wallet contracts only on Oasis Sapphire; a standard EVM does not provide confidential calldata or encrypted contract state.
  • Never hardcode or expose server signers, passwords, API secrets, or private keys.
  • Display recovery material once, avoid persistent browser storage, then clear it from application memory where practical.
  • Show the exact operation details before requesting an action-bound proof.
  • Rate-limit sponsored creation and signing endpoints.
  • Restrict authenticator and implementation targets to reviewed deployments.
  • Treat custom upgrade and executeWithAuth paths as advanced, high-risk operations.

Session safety

API Key Session TOKEN mode deliberately trades per-action binding for bounded automation. A stolen token works until expiration for every selector allowed by its scope mask. Use the shortest viable TTL and rotate immediately after suspected exposure.