Enable Solbound on your website

Choose your access rule

Start with the benefit your site offers. A members page might accept any wallet delegation. An NFT community might require the vault to hold a particular item from its collection. Your server decides which condition applies.

Wallet delegation. Require an active wallet-wide grant from a vault to the signed-in wallet. Anyone with two wallets can satisfy this rule. If only certain vaults should qualify, enforce your membership list on the server or use an asset rule.
Specific NFT. Configure the mint of one classic SPL NFT. The verifier checks the vault’s ownership and the applicable grant.
Verified collection. Configure the Metaplex collection mint. The verifier checks current ownership of a qualifying NFT and its verified collection membership.
Token balance. Set a classic SPL token mint and a minimum as a whole number of base units. For two tokens with six decimals, enter 2000000.

The supplied ownership adapters cover classic SPL tokens and supported Token Metadata NFTs. Core, compressed NFTs and Token-2022 need additional adapters. Wallet, asset and collection scopes describe the visitor’s grant. The access rule describes the evidence your website requires.

Install the SDK

In For Websites, enter your app’s HTTPS origin, its protected path and your holder rule. Choose Generate settings.
On Add Solbound to your app, download the SDK package and save solbound.config.json. Put both beside your app’s package.json. With Node.js 24 and npm, run the command below from that directory.

npm install ./solbound-sdk-0.1.0.tgz

Choose the example that matches your app. The setup page provides copyable snippets, a downloadable examples archive and release checksums.

Next.js. Import the server SDK from a shared Node.js module. Mount the sign-in handlers under /api/solbound/[...action]. Call gate.protect on the route that returns private content.
Node HTTP. Use toNodeHandler to mount the SDK’s Fetch handlers on your HTTP server. Route the private page through gate.protect. The local example signs in at a loopback origin while the verifier checks grants for your configured HTTPS website.
Existing wallet login. Read the delegate address from your verified server session and call solbound.verify on each request. Only an eligible result may receive the protected content.

The optional SolboundSignIn React component accepts a connected wallet with an address and a message-signing function. It talks to your own same-origin endpoints. A standalone reference server is available in the advanced starter source.

Check setup and test access

On Check your setup, choose Run setup check after the SDK health endpoint is available. The browser queries the configured website and compares its reported origin, rule, mint and balance with your settings. The SDK checks the devnet genesis hash and registry deployment. Allow the exact Solbound dashboard origin to read this public health response.

For a local server or an existing login without the health route, run the doctor from your app directory and paste its JSON into the setup page. The result describes the local SDK configuration and network checks.

npx --no-install solbound doctor --config solbound.config.json --json

Use two distinct devnet wallets to test the actual protected resource.

Give the vault enough devnet SOL for fees and record deposits. For an asset rule, put the required holding in the vault. Open Create delegation, grant holder access to your everyday wallet and wait for finalization.
Sign in to your website with the everyday wallet. Request the protected page or action and confirm the response contains the private content.
In My Links, revoke the last applicable grant. After finalization, request the same resource with the same session and confirm access is denied. If access continues, check for another active grant, including an all-apps grant.

For asset-based rules, also test that losing the required holding removes access. Sample grants stay in the browser simulation.

Operate your backend

Keep policy and private RPC credentials on your server. Expose only public installation checks at the health endpoint. Keep protected content out of public HTML and shared caches. Static websites need a backend route that authorizes each private response.

The SDK separates the authenticated delegate from the vault it represents. It checks the permission, vault epoch, scope, expiry and current holding under the server’s configured rule. A missing grant or an unavailable verifier must withhold the benefit. Sensitive actions need this fresh decision even while the sign-in session remains valid.

The built-in sign-in handler keeps expiring challenges and sessions in memory for one process. A deployment spanning processes, serverless functions or hosts needs a shared expiring store with atomic challenge consumption, or your existing server-verified wallet login. Serve the hosted integration over HTTPS. This release checks Solana devnet. Independent review and partner acceptance testing remain open.