Users never hold XLM.
Reserves and fees, charged in the token they already have.
Three moves, one transaction.
-
The sponsor carries the reserves
A sandwich opens around the user’s operations. Their minimum balance stays at zero.
-
The user signs the inner transaction
Reserve never holds a key. It signs only the outer fee-bump, which cannot change what they signed.
-
A path payment buys the XLM
Strict-receive through the DEX. Past the quoted sendMax, nothing happens and they pay nothing.
A key is a bigger bucket, not a permission.
If thirty requests a minute is enough, skip the key. Paste the URL. The service answers either way.
30 / min
No key
Paste the URL. Same endpoints.
600 / min
Key
Sign once with any Stellar wallet.
Paid in what they hold.
Allowlisted assets with a route to XLM. The issuer domain is shown with every code, never the code alone.
- Loading the allowlist…
Raise the limit
Only if the base budget is too tight. Signing again returns the same key. Nothing is stored.
Sign with any Stellar wallet. Thirty requests a minute need no key.
Authorization: Bearer <key>