Blitz automatically authenticates an ordinary Spark session to Flashnet with the same wallet identity

What the evidence shows

Technical and product details

1. Wallet behavior

   After connecting its native Spark wallet, Blitz creates a FlashnetClient around that same wallet with autoAuthenticate enabled and initializes it during the normal connection path. 12

   Supporting material shown on this page

   Blitz automatic Flashnet initializationPinned source code · github.com · checked 2026-08-24

   290      return response.didWork;
   291    } else {
   292      const wallet = await getWallet(mnemonic);
   293      const flashnetAPI = new FlashnetClient(wallet, {
   294        autoAuthenticate: true,
   295      });

   Blitz normal connection pathPinned source code · github.com · checked 2026-08-24

   367      } else {
   368        let alreadyRanConnection = false;
   369        if (!sparkInfoRef.current.identityPubKey && shouldRunNormalConnection) {
   370          await resetSparkState(true, false);
   371          await connectToSparkWallet();
   372          await initializeFlashnet(currentMnemonicRef.current);
   373          alreadyRanConnection = true;

2. Identity mechanism

   Breez's Flashnet authentication asks the Spark wallet for its identity public key, signs the Flashnet challenge with that identity, and keys swap-history requests by the same value. 34

   Supporting material shown on this page

   Flashnet Spark-identity authenticationPinned source code · github.com · checked 2026-08-24

   46    async fn authenticate(&self) -> Result<String, FlashnetError> {
   47        debug!("Authenticating with flashnet");
   48        let identity_public_key = self.spark_wallet.get_identity_public_key().to_string();
   49        let challenge_request = ChallengeRequest {
   50            public_key: identity_public_key.clone(),

   Flashnet identity-keyed historyPinned source code · github.com · checked 2026-08-24

   134    pub async fn list_user_swaps(
   135        &self,
   136        request: ListUserSwapsRequest,
   137    ) -> Result<ListUserSwapsResponse, FlashnetError> {
   138        let request = request.decode_token_identifiers(self.config.network)?;
   139        let identity_public_key = self.spark_wallet.get_identity_public_key();
   140        let endpoint = format!("v1/swaps/user/{identity_public_key}");

Scope control

What this does not establish

• This establishes deterministic technical joinability in the reviewed client path. It does not prove the two companies exchanged the records, attached a civil identity, or used them adversely. 13

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.