SolSub docs

A non-custodial client for an on-chain program — it never holds your keys or funds.

SolSub is a non-custodial client for the Solana Subscriptions & Allowances program (De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44) — an on-chain program that lets your wallet grant someone a bounded permission to pull tokens (how much, how often, and to whom) and then enforces those bounds on every charge.

Everything is pull-based: nothing moves until the authorized party collects, and the program rejects any charge that comes too early, exceeds the cap for the period, or tries to send funds anywhere other than the destinations fixed when the permission was created. The chain is the database — the rules live on-chain, and the chain enforces them. SolSub reads that state, builds the transactions you ask for, and hands them to your own wallet to sign.

Three kinds of on-chain permission — and one cheap answer to "has this wallet paid?"

The program creates three kinds of items, and SolSub shows all of them:

On top of these, SolSub answers one question cheaply for anyone building on it: "has this wallet paid?" — a deterministic on-chain read that needs no database and no account with us.

You keep custody the whole time — no accounts, no tracking, sign each action in your own wallet.

You keep custody the whole time. There are no accounts and no tracking — you connect a Solana wallet and approve each action in that wallet.

• Subscribe. Open a plan's checkout, review the price, token, and period, and sign once in your wallet. That authorizes the merchant to pull up to the plan amount, once per period — and nothing else.
• The small storage deposit. Creating the on-chain permission costs a small refundable SOL deposit (the network's "rent" for the account that stores it). You get it back when you close the item.
• Billing periods & charges. A charge can only land once the current period has elapsed, capped at the plan amount, sent only to the plan's fixed destinations.
• Cancel or resume. Cancel any time; you keep access until the period you already paid for ends, and you can resume before it does.
• Reclaim your deposit. Once an item has expired, close it to get the SOL storage deposit back. You can always subscribe again later.

What you need: a Solana wallet and the plan's token (e.g. USDC). SolSub is pre-launch — try it on devnet first (see Safety & status). If your wallet is on a different network than the plan, signing is refused with a message rather than sending a doomed transaction.

Your connected wallet is the merchant — run subscriptions, not servers.

The merchant is just your connected wallet — it owns your plans and is therefore allowed to charge them. No extra keys, no server, no customer funds held anywhere. Run subscriptions, not servers.

• Create a plan. Set the token, amount, and billing period, and 1–4 payout wallets. Payout destinations are fixed at creation and can never be changed — every collection must go to one of them or the program rejects it.
• See your subscribers. Who's subscribed and whether each is active, due, or cancelled, with payment history. (Listing everyone needs a subscriber-enumeration-capable RPC, e.g. Helius; verifying or charging a known wallet works on any RPC.)
• Collect due charges. Collection is pull-based and, by default, run by you: press Collect due charges and sign in your own wallet. The program rejects a double-charge within a period, so collecting more often than needed is safe.
• Verify access. "Has this wallet paid?" is one cheap on-chain read — the app's Verify screen does it, and your backend can too (see For developers).
• Refunds. There is no on-chain refund — a collected charge is final. SolSub offers a voluntary refund: you sign a plain token transfer from your wallet back to the subscriber. Because it's non-custodial, only you can send it, and it does not cancel the subscription.
• Wind down. Sunsetting a plan blocks new subscribers and freezes its terms while existing subscribers stay chargeable until the end date; after that, delete the plan to reclaim its rent.
• Pullers. You (the owner) can always charge. You may also authorize up to 4 additional puller wallets to charge on your behalf — but a puller can still only charge on time, at the plan amount, to the fixed destinations. It can never redirect funds or change amounts.

The core is free and non-custodial. The only paid part is optional hosted infrastructure.

Creating plans, verifying paid status, and collecting manually are free and fully non-custodial. The only paid part is optional hosted infrastructure — servers SolSub runs so you don't have to. One SolSub license (a subscription to the canonical SolSub plan, paid the same way your subscribers pay you) unlocks all of it, and one license covers all your plans:

• Hosted auto-collection. Instead of pressing the button yourself, SolSub's scheduler charges your due subscribers on a schedule. It signs as an authorized puller — capped, on-time, fixed-destination — and holds no power beyond that.
• Webhooks. Signed HTTP pushes when something happens (a charge, a subscribe, a cancel), so your systems can react (provisioning, dunning, syncing your own database).
• Hosted event history. A durable, queryable log of your plans' lifecycle events — the history the chain itself doesn't keep.

Why these cost money: each is a running service — a scheduler that must fire on time, an indexer that watches the chain, a delivery worker that retries webhooks. The subscription pays for keeping that infrastructure up. It is a convenience, not custody: the hosted job holds only its puller key and gas, never your money.

The paid features are conveniences you can always replace yourself — you are never locked in.

Because SolSub is non-custodial, the paid features are conveniences you can always replace yourself — you are never locked in. If you'd rather not pay for the hosted infra, you can do all of it for free:

• Collect in your own wallet. The Collect due charges button always works, no license needed.
• Run your own puller bot. Authorize your own hot wallet as a puller (see Pullers) and collect on your own schedule. This is the escape hatch that keeps you independent of SolSub.
• Run your own indexer. Point your own provider (e.g. Helius) at the program or your plan addresses and decode events with @solsub/core's decodeSubscriptionEvents.
• Read history the free way. The per-subscription activity view scans recent transactions directly (bounded by what your RPC retains) with no license.
• Verify off any RPC. "Has this wallet paid?" is two point reads you can run yourself — no server, no key tier. The hosted verify endpoint is also free.

You can mix and match: collect manually but index yourself, or run your own puller while reading history with the free scan. Most merchants start with the manual button and only add their own puller or indexer if and when scale calls for it — the hosted features just save you from standing up that infrastructure.

Gate a product on a subscription with no subscriber database of your own.

You can gate a product on a subscription with no subscriber database of your own. Two building blocks, both self-hostable:

• Verify — check access on demand. Prove the visitor controls a wallet (Sign-In-With-Solana), then read status via the free GET /api/v1/verify?cluster=&plan=&wallet= — or compute the same result directly off any RPC with @solsub/core. Because it's self-derivable, SolSub can't "rug" your gate.
• Webhooks — react to events. Register an endpoint and receive signed (HMAC) pushes for charge.succeeded, charge.failed, and subscription.created/cancelled/resumed. Verify the signature over the raw body, then act. Two events have no on-chain transaction — a failed (unfunded) charge and a closed subscription — so an indexer watching plan addresses alone can't see them; SolSub synthesizes charge.failed for charges its own scheduler attempted.

Webhooks are the hosted, paid-convenience path; verify is always free. If you'd rather not depend on our infrastructure, the options are open to you: compute verification off any RPC, and index events yourself — watch the plan addresses, or poll them — instead of receiving pushes. Same data, self-hosted. Detailed integration guides are coming; until then, reach out if you're wiring this up.

Non-custodial by design, pre-launch in practice — try it on devnet.

• Non-custodial. SolSub never holds your keys or funds. Every charge moves tokens directly from a subscriber to the merchant's own payout wallet, on terms approved in the subscriber's wallet — never through us.
• Audit. The underlying Solana Subscriptions & Allowances program is Cantina-audited. SolSub — the client and hosted services — is not itself audited; don't read the program's audit as covering SolSub.
• Status. SolSub is pre-launch. Try it on devnet; treat mainnet use as not production-ready.
• Not financial advice. SolSub is billing software; nothing here is investment advice and there are no yield or return promises.

Something unclear? Reach out.

Questions or something unclear? Reach out on Telegram (t.me/solsub). To install the app, see Get SolSub.