Connect Fireblocks

Connect your Fireblocks workspace and import Solana wallets into SDP.

Use your Fireblocks wallets in SDP. Your workspace keeps the signing keys and controls approvals.

Connection setup

Sign in as an SDP organization admin. Have a Fireblocks workspace owner available for API user approval. If Fireblocks isn't available, ask the SDP team.

Choose an SDP Sandbox project for devnet (SOL_TEST) or Production project for mainnet (SOL, mainnet access required). Each selected vault must already contain a Solana wallet on that network. SDP project environments are separate from Fireblocks workspace types; check workspace compatibility with the SDP team.

  1. Generate a CSR in SDP. Open Integrations → Fireblocks → Add connection, enter a Connection name, and click Generate and download CSR. SDP creates the API authentication key. Share only the CSR, never a private key. Register within seven days.

  2. Register an API user in Fireblocks. Open Developer center → API users → Add API user. Name it, choose Editor, upload the CSR, and click Add user. Have the workspace owner approve it; wait until active.

    For IP-restricted keys, get SDP's outbound IPs from the SDP team. Have an authorized operator add them under ⋯ → Allowlist IP address before continuing.

  3. Import vaults in SDP. Copy API User (ID) into SDP. Click Load vaults, select up to 20 vaults, then Connect and verify. SDP checks API access and each wallet's address, then lists imported wallets on the connection page and under Wallets. This does not test signing or transfer policies.

Transfers

These steps enable direct SOL and canonical USDC transfers. Fireblocks signs and broadcasts them. RAW signing and SDP fee sponsorship are not used.

Configure approvals

Have an authorized Fireblocks operator open Security → Policies → Transfer → Edit policy → Add rule:

  • Scope: your SDP API user as Initiator, allowed vaults and destinations, and an address type permitting one-time addresses.
  • Funds: allowed assets and amount limits.
  • Action: Request approval, your Approver set and Threshold, then Designated signer → Users and your organization's signer.

Publish the rule. SDP uses one-time address transfers, so set Settings → General → One-time address transactions to Allow. Complete the required approvals for both changes.

Check the policy yourself: SDP's Editor user cannot read policies, and the Pay reminder does not detect a missing policy.

Fund and test

Open Accounts → Vault, select the source vault's Solana wallet, and use its deposit address. Add SOL for network fees, including for USDC transfers.

Send a small payment, then open Payments → Transactions in SDP. While awaiting approval, it shows Processing; open it for the Fireblocks transaction ID and status.

Approve the matching transaction in Fireblocks. In Transaction history, confirm COMPLETED; SDP should show Confirmed.

Manage your connection

RAW signing and ownership checks

Batch payments and the optional ownership check require workspace RAW signing and a RAW policy permitting the SDP API user with your designated signer. If disabled, ask your Fireblocks Customer Success Manager to enable it. An API Co-signer isn't required.

Open the wallet's Settings → Ownership → Prove ownership and approve promptly in Fireblocks. SDP simulates the signed transaction without broadcasting. The check requires a configured, funded SDP fee payer.

Rotate credentials

In Integrations → Fireblocks, select the connection and Rotate secret. Generate a new CSR, register a replacement Editor user, and get owner approval. Before switching, add it to the old Initiator policies and set its IP allowlist.

Select the original verification vault. SDP checks every wallet before switching. Keep the old user active and permitted for the 24-hour rollback window.

Disconnect

In Fireblocks, choose Developer center → API users → ⋯ → Delete for the SDP API user. If unavailable, ask an authorized operator.

SDP blocks connection deactivation while wallets are active and cannot deactivate Fireblocks wallets. Contact the SDP team for cleanup.

Deleting the user does not cancel accepted payments. Reject or cancel them in Fireblocks too; cancellation can race execution.

Credential storage

API credentials default to GCP Secret Manager on hosted SDP and encrypted database storage when self-hosted. Pending CSR keys are encrypted and deleted after registration or expiry.

Transfer troubleshooting

Blocked by policy

In Transaction history, expand the transaction and check Status and Sub-status. Inspect Policy uses the current policy, which may differ from the original. Pending approval is not a refusal.

Refused submissions and replays return HTTP 422 with error.code: "CUSTODY_POLICY_REFUSED". Later refusals mark the transfer failed; the dashboard shows a wallet-policy error.

Recipient whitelisting

Manage Fireblocks whitelists under Whitelisted addresses. Check the Solana network and address. Creating an SDP contact does not whitelist an address.

Submission timed out

Keep the original Idempotency-Key and check the existing payment before intentionally starting another.