<div align="center">
<br />
<img src="./kora.svg" alt="Kora" width="140" />
<br />
<br />
<h3>Kora: Solana Signing Infrastructure</h3>
<br />
[](https://github.com/solana-foundation/kora/actions/workflows/integration.yml)
[](https://deepwiki.com/solana-foundation/kora)
[](https://crates.io/crates/kora-cli)
[](https://www.npmjs.com/package/@solana/kora)
[](https://opensource.org/licenses/MIT)
<br />
<br />
</div>
> **Branch Model (Mar 18, 2026):** `main` is the integration branch and may contain audited and unaudited commits. Audit status is tracked per commit/tag in [`audits/AUDIT_STATUS.md`](audits/AUDIT_STATUS.md). Stable production releases are published from tagged audited snapshots.
**Kora is your Solana signing infrastructure.** Enable gasless transactions where users pay fees in any token—USDC, BONK, or your app's native token—or handle any transaction signing that requires a trusted signer.
### Why Kora?
- **Better UX**: Users never need SOL
- **Revenue Control**: Collect fees in USDC, your token, or anything else
- **Production Ready**: Secure validation, rate limiting, monitoring built-in
- **Easy Integration**: JSON-RPC API + TypeScript SDK
- **Flexible Deployment**: Railway, Docker, or any cloud platform
### Architecture
- **Language**: Rust with TypeScript SDK
- **Protocol**: JSON-RPC 2.0
- **Signers**: Solana Private Key, Turnkey, Privy, Openfort
- **Authentication**: API Key, HMAC, or none
- **Deployment**: Flexible deployment options (Docker, Railway, etc.)
### Features
- Configurable validation rules and allowlists
- Full Token-2022 support with extension filtering
- Redis caching for improved performance
- Rate limiting and spend protection
- Secure key management (Turnkey, Privy, Vault, Openfort)
- HMAC and API key authentication
- Prometheus metrics and monitoring
- Enhanced fee payer protection policies
## Quick Start
Install Kora:
```bash
cargo install kora-cli
```
Basic usage:
```bash
kora rpc [OPTIONS] # --help for full list of options
```
**[→ Full Documentation](https://launch.solana.com/docs/kora/getting-started)** - Learn how Kora works
**[→ Quick Start Guide](https://launch.solana.com/docs/kora/getting-started/quick-start)** - Get Kora running locally minutes
**[→ Node Operator Guide](https://launch.solana.com/docs/kora/operators)** - Run a paymaster
**[→ Kora Node Providers](https://solana.com/docs/tools/kora/providers)** - Use a hosted Kora node (for example Openfort or Pimlico) instead of running your own
## TypeScript SDK
Kora provides a simple JSON-RPC interface:
```typescript
// Initialize Kora client
import { KoraClient } from '@solana/kora';
const kora = new KoraClient({ rpcUrl: 'http://localhost:8080' });
// Sign transaction as paymaster
const signed = await kora.signTransaction({ transaction });
```
**[→ API Reference](https://launch.solana.com/docs/kora/json-rpc-api)**
## Local Development
### Prerequisites
- [Just](https://github.com/casey/just) (command runner)
- Rust 1.86+
- Solana CLI 2.2+
- Node.js 20+ and pnpm (for SDK)
### Installation
```bash
git clone https://github.com/solana-foundation/kora.git
cd kora
just install
```
### Build
```bash
just build
```
### Running the Server
Basic usage:
```bash
kora rpc [OPTIONS]
```
Or for running with a test configuration, run:
```bash
just run
```
### Local Testing
And run all tests:
```bash
just test
```
## Repository Structure
```
kora/
├── crates/ # Rust workspace
│ ├── kora-lib/ # Core library with RPC server (signers, validation, transactions)
│ └── kora-cli/ # Command-line interface and RPC server
├── sdks/ # Client SDKs
│ └── ts/ # TypeScript SDK
├── tests/ # Integration tests
├── docs/ # Documentation
│ ├── getting-started/ # Quick start guides
│ └── operators/ # Node operator documentation
├── justfile # Build and development commands
└── kora.toml # Example configuration
```
## Security Audit
Kora has been audited by [Runtime Verification](https://runtimeverification.com/). View the [audit report](audits/20251119_runtime-verification.pdf).
Audit status, audited-through commit, and the current unaudited delta are tracked in [audits/AUDIT_STATUS.md](audits/AUDIT_STATUS.md).
**Note:** Kora uses the `solana-keychain` package which has not been audited. Use at your own risk.
## Community & Support
- **Questions?** Ask on [Solana Stack Exchange](https://solana.stackexchange.com/) (use the `kora` tag)
- **Issues?** Report on [GitHub Issues](https://github.com/solana-foundation/kora/issues)
- **Operators:** Running Kora in production? Reach out to [@a_milz](https://x.com/a_milz) or [@dev_jodee](https://x.com/dev_jodee) on X to join our operator Slack channel for updates and support
## Other Resources
- [Kora CLI Crates.io](https://crates.io/crates/kora-cli) - Rust crate for running a Kora node
- [Kora Lib Crates.io](https://crates.io/crates/kora-lib) - Rust crate for the Kora library
- [@solana/kora](https://www.npmjs.com/package/@solana/kora) - TypeScript SDK for Kora
---
Built and maintained by the [Solana Foundation](https://solana.org).
Licensed under MIT. See [LICENSE](LICENSE) for details.
## Disclaimer
The content herein is provided for educational, informational, and entertainment purposes only, and does not constitute an offer to sell or a solicitation of an offer to buy any securities, options, futures, or other derivatives related to securities in any jurisdiction, nor should not be relied upon as advice to buy, sell or hold any of the foregoing. This content is intended to be general in nature and is not specific to you, the user or anyone else. You should not make any decision, financial, investment, trading or otherwise, based on any of the information presented without undertaking independent due diligence and consultation with a professional advisor. Solana Foundation Foundation and its agents, advisors, council members, officers and employees (the "Foundation Parties") make no representation or warranties, expressed or implied, as to the accuracy of the information herein and expressly disclaims any and all liability that may be based on such information or any errors or omissions therein. The Foundation Parties shall have no liability whatsoever, under contract, tort, trust or otherwise, to any person arising from or related to the content or any use of the information contained herein by you or any of your representatives.