> For the complete documentation index, see [llms.txt](https://raiden-4.gitbook.io/raiden.wtf.docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://raiden-4.gitbook.io/raiden.wtf.docs/bolt-low-latency/authentication/quic-authentication.md).

# QUIC Authentication

Certificate-based authentication for QUIC connections

The QUIC protocol uses certificate-based authentication. Your API key is embedded in the TLS handshake — no header needed.

## How It Works

1. Take your API key and compute `SHA-256(api_key)` to get a 32-byte seed
2. Use the seed to derive an ed25519 keypair: `ed25519.NewKeyFromSeed(seed)`
3. Create a self-signed X.509 certificate with the ed25519 public key
4. Present this certificate as a TLS client certificate when connecting via QUIC

The server derives the same public key from your API key and verifies it matches the certificate you present. No API key is sent over the wire.

## Key Derivation

```
API Key → SHA-256 → 32-byte seed → ed25519 keypair → self-signed certificate
```

{% hint style="info" %}
The certificate is deterministic — the same API key always produces the same keypair. Generate it once and reuse it across connections.
{% endhint %}

## Example (Go)

```go
import (
    "crypto/ed25519"
    "crypto/sha256"
    "crypto/tls"
    "crypto/x509"
    "crypto/rand"
    "math/big"
    "time"
)

apiKey := "YOUR_API_KEY"

// Step 1-2: Derive ed25519 keypair from API key
hash := sha256.Sum256([]byte(apiKey))
priv := ed25519.NewKeyFromSeed(hash[:])
pub := priv.Public().(ed25519.PublicKey)

// Step 3: Create self-signed certificate
template := &x509.Certificate{
    SerialNumber: big.NewInt(1),
    NotBefore:    time.Now().Add(-time.Hour),
    NotAfter:     time.Now().Add(365 * 24 * time.Hour),
    KeyUsage:     x509.KeyUsageDigitalSignature,
}
certDER, _ := x509.CreateCertificate(rand.Reader, template, template, pub, priv)
cert := tls.Certificate{Certificate: [][]byte{certDER}, PrivateKey: priv}

// Step 4: Use in TLS config
tlsConf := &tls.Config{
    Certificates:       []tls.Certificate{cert},
    InsecureSkipVerify: true,
    NextProtos:         []string{"raiden-tpu"},
}
```

## Connection Errors

| Error Code | Meaning                                      |
| ---------- | -------------------------------------------- |
| `1`        | Unknown certificate — API key not recognized |
| `3`        | QUIC access not enabled on account           |
| `4`        | Account suspended or banned                  |

{% hint style="warning" %}
QUIC access is currently **on-demand only**. Contact the Raiden team to get it enabled on your account.
{% endhint %}