QUIC Authentication

Certificate-based authentication for QUIC connections

The QUIC protocol uses certificate-based authentication. Your API key is embedded in the TLS handshake — no header needed.

How It Works

Take your API key and compute SHA-256(api_key) to get a 32-byte seed
Use the seed to derive an ed25519 keypair: ed25519.NewKeyFromSeed(seed)
Create a self-signed X.509 certificate with the ed25519 public key
Present this certificate as a TLS client certificate when connecting via QUIC

The server derives the same public key from your API key and verifies it matches the certificate you present. No API key is sent over the wire.

Key Derivation


API Key → SHA-256 → 32-byte seed → ed25519 keypair → self-signed certificate

The certificate is deterministic — the same API key always produces the same keypair. Generate it once and reuse it across connections.

Example (Go)


import (
    "crypto/ed25519"
    "crypto/sha256"
    "crypto/tls"
    "crypto/x509"
    "crypto/rand"
    "math/big"
    "time"
)
 
apiKey := "YOUR_API_KEY"
 
// Step 1-2: Derive ed25519 keypair from API key
hash := sha256.Sum256([]byte(apiKey))
priv := ed25519.NewKeyFromSeed(hash[:])
pub := priv.Public().(ed25519.PublicKey)
 
// Step 3: Create self-signed certificate
template := &x509.Certificate{
    SerialNumber: big.NewInt(1),
    NotBefore:    time.Now().Add(-time.Hour),
    NotAfter:     time.Now().Add(365 * 24 * time.Hour),
    KeyUsage:     x509.KeyUsageDigitalSignature,
}
certDER, _ := x509.CreateCertificate(rand.Reader, template, template, pub, priv)
cert := tls.Certificate{Certificate: [][]byte{certDER}, PrivateKey: priv}
 
// Step 4: Use in TLS config
tlsConf := &tls.Config{
    Certificates:       []tls.Certificate{cert},
    InsecureSkipVerify: true,
    NextProtos:         []string{"raiden-tpu"},
}

Connection Errors

Error Code	Meaning
`1`	Unknown certificate — API key not recognized
`3`	QUIC access not enabled on account
`4`	Account suspended or banned

QUIC access is currently on-demand only. Contact the Raiden team to get it enabled on your account.