Canton Production Best Practices

Overview

Canton gives you structural security at the protocol level — authorization is declared in Daml, privacy is enforced by the synchronizer, and the ledger guarantees non-repudiation. Your job is to build on these foundations without introducing gaps off-ledger (auth, keys, secrets, input validation).

On-ledger security

Daml's authorization model is your first line of defense — the protocol enforces it; no API manipulation can bypass it.

• Declare the minimum signatories per template.
• Use observer to grant visibility without the ability to act.
• Prefer propose-accept for multi-party agreements so no party can unilaterally create obligations for others.
• Validate business rules in ensure clauses (checked on create and on fetch/exercise).
• For complex flows, use delegation contracts (e.g. an AuthorizedAgent the principal can archive to revoke) instead of broad permissions — explicit and auditable.

Ledger API authentication

Validators protect the Ledger API with JWT tokens; present a valid token on every call.

• Never put tokens in client-side code, logged env vars, or version control.
• Refresh before expiry; use separate service accounts per component (backend/automation/admin) to limit blast radius.
• gRPC: configure call credentials. HTTP/JSON: Authorization: Bearer <token>.