How signing works

There are no API keys. Your wallet is your identity, in two ways:

Signed transactions. Launching on purps.lol or pump.fun, routing fees, sending: you sign the transaction itself in your wallet, and that’s the authorisation. A launch is one call that returns unsigned transactions. There’s no message.
Signed terms. Three things sign a short text message first: a Pons launch (it’s invite-only, so we check the invite before anything is spent; one message covers the launch and its strategy), wiring a strategy onto a coin launched without one (on purps.lol, or a Pons launch made without a config), and creator authority. These come as a prepare / submit pair.

The pair works like this:

Prepare

POST …/prepare with the terms. You get the exact text to sign as message, and ts, the timestamp embedded in it. Nothing is stored or spent.

Sign

Sign message in your wallet. It spells the terms out in words next to their hash (a launches: or sets: line), so nothing can change between the two calls. A strategy sent the short way ({ preset, markets }) is expanded first, so the words and the hash describe the full strategy it becomes.

Submit

POST …/submit with the same terms, plus ts and signature. Signatures are valid for five minutes.

Solana

Sign the message’s UTF-8 bytes with ed25519, the same thing a wallet’s signMessage does. No prefix, no hashing. Send the signature as base58.

import nacl from "tweetnacl";
import bs58 from "bs58";

const config = { preset: "balanced", markets: ["ETH"] };
const { data } = await fetch(`https://purps.lol/api/v2/coins/${mint}/strategy/prepare`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ config }),
}).then((r) => r.json());

const bytes = new TextEncoder().encode(data.message);
const signature = bs58.encode(nacl.sign.detached(bytes, keypair.secretKey));

await fetch(`https://purps.lol/api/v2/coins/${mint}/strategy/submit`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ config, ts: data.ts, signature }),
});

With a browser wallet, const sig = await wallet.signMessage(bytes) gives you the same bytes to base58-encode.

Pons (Robinhood Chain)

Sign with personal_sign (EIP-191). With viem:

const signature = await walletClient.signMessage({ message: data.message });

Send the 0x-hex signature as returned. The wallet address in the message is lower-cased; send creatorWallet in any case and we lower-case it the same way.

Creator authority

Steering a coin adds one thing: a nonce. Prepare issues it bound to the coin, the signing wallet and the exact action. It sits inside the signed words, lasts five minutes, and the signature you send with it works once. Send it back with ts and signature. The message is plain English: a does: or sets: line says what will happen, why: is your note, and holders see both on the coin’s Changes tab. One action, end to end, from a keypair file:

import fs from "node:fs";
import { Keypair } from "@solana/web3.js";
import nacl from "tweetnacl";
import bs58 from "bs58";

const API = "https://purps.lol/api/v2";
const owner = Keypair.fromSecretKey(Uint8Array.from(JSON.parse(fs.readFileSync("owner.json", "utf8"))));
const mint = "…";

async function call(path, body) {
  const res = await fetch(API + path, body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : undefined);
  const json = await res.json();
  if (!json.ok) throw new Error(`${path}: ${json.error}`);
  return json.data;
}

// what the coin allows right now
const authority = await call(`/coins/${mint}/authority`);
if (!authority.available || authority.state !== "on") throw new Error(authority.reason ?? `authority is ${authority.state}`);

// 1. prepare: the wallet, the action, the reason
const terms = {
  wallet: owner.publicKey.toBase58(),
  kind: "action",
  action: { action: "close", market: "ETH", margin: "hold" },
  note: "Taking ETH off ahead of the weekend",
};
const { ts, nonce, message } = await call(`/coins/${mint}/authority/prepare`, terms);
console.log(message); // read it: it says exactly what will happen

// 2. sign exactly that string
const signature = bs58.encode(nacl.sign.detached(new TextEncoder().encode(message), owner.secretKey));

// 3. submit
const result = await call(`/coins/${mint}/authority/submit`, { ...terms, ts, nonce, signature });
console.log("queued", result.queued);

// 4. watch the Changes log until the engine reports back
for (;;) {
  const [latest] = await call(`/coins/${mint}/changes?limit=1`);
  if (latest?.status === "done") break;
  if (latest?.status === "failed") throw new Error(latest.error ?? "failed");
  await new Promise((r) => setTimeout(r, 3000));
}

The signature is checked against the wallet named in prepare: the coin’s owner, or a platform admin wallet. Every check that guards money runs at submit, on the server’s own figures. If the coin page would refuse a move, submit refuses it too, with a 422 and the reason.

Transactions

We never sign your transactions. On Solana, a build returns unsigned transactions as base64. You sign them and send them through your own node or POST /transactions/send. The relay is only required for a purps.lol create, where it adds the launchpad’s memo signature, and it only forwards the shapes a launch flow produces. On Pons, submit returns EVM transactions as { to, data, value, chainId } steps that you send from your own wallet. When a flow gives you more than one transaction, send them in order and wait for each to confirm before sending the next: a later one spends what an earlier one produced. /transactions/send waits up to 8 seconds by default (send wait for up to 30) and returns confirmed. If that’s false, poll GET /transactions/{signature} every couple of seconds until it’s true. That poll reads Solana on your own Helius key, sent as X-Helius-Key; a free key is enough, or poll your own node instead. A launch’s create transaction also needs the mint keypair’s signature. The build returns it as mintSecret. It has no power beyond that one transaction.

import { Keypair, VersionedTransaction } from "@solana/web3.js";
import bs58 from "bs58";

// creatorKeypair is your wallet; build is the answer from POST /launches
const tx = VersionedTransaction.deserialize(Buffer.from(build.transactions[build.createIndex], "base64"));
tx.sign([creatorKeypair, Keypair.fromSecretKey(bs58.decode(build.mintSecret))]);
const signed = Buffer.from(tx.serialize()).toString("base64");

Start here

Launch

After launch

Solana

Pons (Robinhood Chain)

Creator authority

Transactions

​Solana

​Pons (Robinhood Chain)

​Creator authority

​Transactions

Solana

Pons (Robinhood Chain)

Creator authority

Transactions