Canton Network Onboarding Guide

Get Started

CF Onboarding & Dev Fund Guide

Everything builders, validators, and grant applicants need in one place.

DevNet Build
TestNet Validate at scale
MainNet Production live

Every participant follows the same progression. Each network needs its own allowlisted egress IP.

Part 1

Builder onboarding

A step-by-step path for builders and validators joining the Canton ecosystem.

Before you start

Choose your path

All participants follow the same network progression. Which steps apply depends on what you're here to do. Pick a path to highlight your route through the guide.

App Builder

Install the SDK, build locally, then get allowlisted and deploy through DevNet, TestNet, and finally MainNet.

Steps 1 to 7

Validator only

Skip the SDK and local dev steps and start at Step 3 (hosting model). Tokenomics Committee approval is required before you can join TestNet or MainNet.

Steps 3 to 7

01

App Builders only

Install dpm

Install the Daml Package Manager (dpm).

install dpm
curl https://get.digitalasset.com/install/install.sh | sh

Then create a new project:

new project
dpm new my-project --template daml-intro-contracts
02

App Builders only

Set up local development

Before moving to DevNet, you can try the Canton Network Quickstart to run a LocalNet.

Requirements

Docker with 8 GB+ RAM (set in Docker Desktop settings) · Java SDK Eclipse Temurin JDK 21.

quickstart
git clone https://github.com/digital-asset/cn-quickstart.git
cd cn-quickstart/quickstart
make setup    # choose standard/test mode, OAuth options
make build
make start    # first run triggers setup assistant

Once running, access the local UIs:

03

Validator ops can start here

Choose your hosting model

Decide how you want to run your validator node before requesting any network access.

Self-host

You manage all infrastructure, upgrades, and maintenance across every network.

04

Infrastructure

Set up a static egress IP

All traffic from your validator to the Super Validators must leave from a static egress IP that the SVs add to their allowlists. Provision it before requesting network access.

You need one IP per network, and each must be different from the IP you use on any other network. Plan for three separate IPs if you're going all the way to MainNet.

05

Sponsorship

Find a Super Validator sponsor

You need an existing Super Validator (SV) to sponsor your onboarding. Your sponsor will:

  • Get your egress IP added to the SV allowlists for each network you join.
  • Provide your onboarding secret on TestNet and MainNet. You can't self-serve it on those networks (on DevNet you can, see Step 6c).
  • Point you to the Canton software packages needed to set up your node.

Browse active Super Validators and reach out directly. Confirm your sponsor before submitting any allowlisting forms, since their contact details will be required.

No sponsor yet?

The Canton Foundation can act as your sponsor. Reach out at canton.foundation.

06

Get started

Get onto DevNet

6a

Request DevNet allowlisting

Submit your DevNet egress IP via the DevNet allowlisting form.

The Super Validators then need to adopt the updated IP allowlist. This usually takes 2 to 7 days.

DevNet allowlisting form →

6b

Set up your node infrastructure

While waiting for allowlisting, prepare your node environment:

  • Provision a VM (Docker Compose) or Kubernetes cluster. Kubernetes is recommended for production.
  • Set up OIDC authentication (Auth0, Keycloak, or equivalent).
  • Get the Canton software packages for the version the network is running.

6c

Get your DevNet onboarding secret

Once your IP is allowlisted, get your onboarding secret. On DevNet you can self-serve this:

onboarding secret
curl -X POST SPONSOR_SV_URL/api/sv/v0/devnet/onboard/validator/prepare

Self-generated DevNet secrets are valid for 1 hour, so generate one right before you deploy. SV URLs are listed at canton.foundation/sv-network-status-2.

You're on DevNet

You can now set up parties, upload DARs, test token transfers & run onboarding workflows. DevNet is reset every few months, so don't rely on it for long-lived data.

07

Going live

Apply for TestNet & MainNet

Joining TestNet requires approval to join MainNet, so you apply for both at once. Submit your application while you're still working on DevNet: approval runs in parallel, so you don't need to wait until DevNet testing is complete.

Timeline

End-to-end approval typically takes at least 2 to 3 weeks. Applications go through manual compliance review (banned countries and invalid contacts are rejected), then Tokenomics Committee review on a weekly cadence. After approval, allow another 2 to 7 days for SVs to adopt your IP on each network.

TestNet

Requires Tokenomics Committee approval, a TestNet egress IP on the allowlist, and an onboarding secret from your SV sponsor (no self-serve). Sponsor-issued secrets are one-time use and valid for 48 hours. TestNet is reset every 3 to 6 months.

MainNet

Everything TestNet requires, with its own separate egress IP and sponsor-issued secret. MainNet is never reset. Once live, your validator is eligible for Canton Coin rewards.

Reference

Onboarding links in one place

Copied to clipboard