The Subscriptions Delegation Program enables developers to let users authorize future token transfers from their wallets with clear limits. It is designed for recurring payments, subscriptions, merchant billing, and other flows where a user should not have to sign every transfer manually.
Purpose
Solana token accounts can approve another authority to move tokens, but each token account can only have one approved authority at a time. That makes it hard for one wallet to safely support several spending arrangements for the same token, such as a monthly subscription, a fixed spending allowance, and a merchant billing agreement.
This program solves that by giving each (user, token mint) pair a
program-controlled Subscription Authority. The user's token account approves
that authority once. The program then checks each requested transfer against a
separate record that defines who can pull funds, how much they can pull, and
when the authorization expires or resets.
The Subscription Authority cannot move funds by itself. A transfer only succeeds when it matches one of the user's active authorizations.
Program ID
De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44
The program ID is declared in program/src/lib.rs. Local Surfpool workflows
install the program at this canonical address.
Delegation Models
The program supports three authorization models:
| Model | Purpose |
|---|---|
| Fixed delegation | Let another wallet or service spend up to a fixed total amount, optionally until an expiry time. |
| Recurring delegation | Let another wallet or service spend up to a limit that resets every period, such as daily, weekly, or monthly. |
| Subscription plan | Let a merchant publish billing terms that users can accept, then allow approved collectors to charge subscribers each billing period. |
Supported Tokens
Supports all mints from both SPL Token and Token-2022.
For Token-2022 mints with a configured TransferHook, the program forwards the
mint's hook accounts (hook program, ExtraAccountMetaList PDA, extras) into the
TransferChecked CPI on each delegated transfer, so the hook policy is
enforced. The SDK resolves them for you:
- Plugin client (
transferFixed,transferRecurring,transferSubscription) — appended automatically. - Building manually — call
resolveTransferHookAccounts, passtransferHookAccounts.
On-Chain Events
The program emits on-chain events via self-CPI so indexers and applications can track activity. All events are registered in the published IDL, so generated clients can decode them. The emitted events are:
FixedTransferEvent,RecurringTransferEvent, andSubscriptionTransferEvent— one per delegated transfer. Each carries the creditedreceiverTokenAccount;SubscriptionTransferEventalso carries thepuller.SubscriptionCreatedEvent,SubscriptionCancelledEvent, andSubscriptionResumedEvent— subscription lifecycle.SubscriptionCreatedEventcarries thepayer.PlanUpdatedEvent— emitted when a plan is updated.
Versioning
Program-owned records include a version field. This gives the program a path to upgrade account data over time without breaking existing users. The migration strategy supports:
- Lazy in-place update
- Explicit migrate instruction
- Revoke and recreate fallback
Contributors
The project is maintained by contributors to the
solana-program/subscriptions repository.
Audit Status
The program has been audited by Cantina. Audit status, baseline commit,
fix-verified commit, and current unaudited delta are tracked in the repository's
audits/ directory.
Demo Application
If you want to play around with the program yourself, you can view an example application here to see an end-to-end implementation of the concepts covered in this section.
Is this page helpful?