Payments And Wallets

Payments and wallets

Build payment flows and wallet integrations using light-token on Solana. The light-token API matches SPL-token and extends it to include the light token program.

Workflow

1. Clarify intent
   • Recommend plan mode, if it's not activated
   • Use AskUserQuestion to resolve blind spots
   • All questions must be resolved before execution
2. Identify references and skills
   • Match task to domain references below
   • Locate relevant documentation and examples
3. Write plan file (YAML task format)
   • Use AskUserQuestion for anything unclear — never guess or assume
   • Identify blockers: permissions, dependencies, unknowns
   • Plan must be complete before execution begins
4. Execute
   • Use Task tool with subagents for parallel research
   • Subagents load skills via Skill tool
   • Track progress with TodoWrite
5. When stuck: ask to spawn a read-only subagent with Read, Glob, Grep, and DeepWiki MCP access, loading skills/ask-mcp. Scope reads to skill references, example repos, and docs.

API overview

Plural functions (createTransferInterfaceInstructions, createUnwrapInstructions) return TransactionInstruction[][] — each inner array is one transaction. They handle loading cold accounts automatically.

Domain references

Setup

npm install @lightprotocol/compressed-token@beta @lightprotocol/stateless.js@beta @solana/web3.js @solana/spl-token

import { createRpc } from "@lightprotocol/stateless.js";
import {
  createLoadAtaInstructions,
  loadAta,
  createTransferInterfaceInstructions,
  transferInterface,
  createUnwrapInstructions,
  unwrap,
  getAssociatedTokenAddressInterface,
  getAtaInterface,
  wrap,
} from "@lightprotocol/compressed-token/unified";

const rpc = createRpc(RPC_ENDPOINT);

Resources

• Payments docs
• Wallets docs
• GitHub examples
• Nullifier program

SDK references

Security

The Privy signing examples transmit secrets to an external API — review sign-with-privy.md before running.

• Declared dependencies. HELIUS_RPC_URL is required for all examples. The Privy signing flow additionally requires PRIVY_APP_ID, PRIVY_APP_SECRET, TREASURY_WALLET_ID, and TREASURY_AUTHORIZATION_KEY — get these at privy.io. Load secrets from a secrets manager, not agent-global environment.
• Privy signing flow. PRIVY_APP_SECRET and TREASURY_AUTHORIZATION_KEY are sent to Privy's signing API. Verify these only reach Privy's official endpoints. See sign-with-privy.md.
• Subagent scope. When stuck, the skill asks to spawn a read-only subagent with Read, Glob, Grep scoped to skill references, example repos, and docs.
• Install source. npx skills add Lightprotocol/skills from Lightprotocol/skills.
• Audited protocol. Audit reports at github.com/Lightprotocol/light-protocol/tree/main/audits.