It is important to understand where you are using your Paymaster endpoint as anyone who has your key can send requests to sponsor transactions. We strongly recommend setting up a contract allowlist on your paymaster configuration which will lock down your paymaster to only sponsor transactions on your wallet. Further security measures such as setting up a paymaster Proxy so that your api key is not leaked is also recommended. If you are in a situation where you can not add a contract allowlist due to dynamic calls to contracts that are not on policy then you must set up a paymaster proxy on your backend such that your api token does not get leaked. Set sponsorship limits to further ensure you’re only sponsoring what you want to.

​
Paymaster Proxy

Creating an API to proxy calls to your paymaster service is important for two reasons.
  • Allows you to protect any API secret.
  • Allows you to add extra validation on what requests you want to sponsor.
You can see more details on implementing a paymaster proxy at smartwallet.dev.