Practical overview
When it fits
Use Boltwall when integrating Lightning payment challenges and LSAT authentication into an existing server to control access to selected API endpoints.
Who it is for
- Developers adding payment-gated access to APIs they operate.
- Server teams that want LSAT-based authorization rather than conventional user accounts or API keys.
Documented uses
- Place a payment requirement in front of selected API routes.
- Issue and use LSAT credentials to authenticate requests to protected routes.
- Apply macaroon-based authorization configurations, including optional time or IP restrictions.
Requirements & limits
Boltwall is provided in a public GitHub repository. The repository evidence supplied does not include license information.
- A Lightning node or the documented OpenNode API-key connection configuration is required.
- The documented baseline uses Express 4.x, cors and body-parser; Restify is mentioned but not broadly tested.
- Middleware placement determines which routes are protected.
- The README describes HODL invoices and optional time- and IP-restricted access configurations.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Add Boltwall middleware to selected API routes
Configure Boltwall to require payment and LSAT authentication for routes registered after the middleware.
Before you start
- Node.js above 11.10.0 and npm above 6.9.0
- An Express 4.x project with cors and body-parser middleware
- Lightning connection configuration and settings for managing and signing authentication macaroons
Steps
Install Boltwall from npm in the existing server project.
Configure the required environment variables for the Lightning connection and macaroon handling.
Register cors and body-parser middleware, then register public routes that should remain unprotected.
Add Boltwall middleware before the routes that should require payment and authentication.
Expected outcome
Routes registered after Boltwall require proper authentication; the documented payment flow provides an LSAT challenge for protected-route requests.
Guide limitations
- Middleware order determines which routes are protected; routes registered before Boltwall remain unprotected.
- Restify is mentioned as supported but not broadly tested.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 18 October 2026
- Original website title
- Tierion/boltwall · Official homepage title · retained in its source language