If you run a Canton node with keys in Fireblocks, you have best in class custody. Fireblocks protects your keys and enforces your policies. But your Canton operations need to use those keys. They need to sign smart contracts. They need audit trails that prove every signature.
The External Signer bridges this gap. It extends the security and control that Fireblocks provides directly into your Canton infrastructure. The parties on your Canton node sign their transactions using Fireblocks protected keys. Your custody policies stay enforced throughout. Everything is auditable.
What It Does
When you need to sign a DAML operation using keys stored with Fireblocks, External Signer lets the client app call the External Signer with a JWT; the Signer calls the participant’s JSON Ledger API to prepare the transaction and sends the hash to Fireblocks for signing, then executes on the participant node.
The result is a seamless mapping of multiple party IDs to different individual vaults in your Fireblocks workspace, providing a comprehensive and cost effective way to manage your institutional customers and assets. Your Canton transactions use Fireblocks custody. Your policies are enforced at signing time. Your audit trail is complete.
Multiple individual party IDs can sign using multiple individual vaults within your Fireblocks workspace. This means each party’s signing key is isolated in its own vault, and each party’s assets sit under its own party ID on the ledger. Keys stay separate. Assets stay separate. No vault can sign another party’s operations. This is the isolation that regulated institutions require.
Why Launchnodes Built It
We have run Canton nodes and helped institutions bring workflows onchain. We understand how clients need to isolate individual party IDs to individual vaults.
Fireblocks is excellent at what it does. The External Signer is built to let your Canton infrastructure use that excellence. It was designed by people who have actually done this in production, at scale, for regulated institutions.
External Audit as Proof
The External Signer has been externally audited. Auditors verified that Canton operations signed through the External Signer are cryptographically valid, that Fireblocks policies are enforced, and that audit trails are complete and unbroken.
Audit reports are available to all our customers. When auditors want to understand how signing works, you can show them a third party assessment.
For Your Operations
If you custody keys in Fireblocks and run a Canton node, the External Signer lets you map individual party IDs to individual vaults in a single workspace. Custody policies stay enforced. Your audit trail shows exactly what happened.
Multiple parties can operate independently within the same Fireblocks workspace. Each maintains their own vault. Each party’s keys are isolated. Each party’s Canton operations are isolated. Your customers benefit because their operations move through your Canton node cleanly and securely. Keys are protected. Funds are segregated. Signing is fast and reliable. Everything is verifiable.
External Signer extends the value of Fireblocks custody.
Fireblocks secures your keys. Canton manages your smart contracts. The External Signer lets them work together.
It is built by people who have run Canton nodes with institutional custody. It is verified by external auditors. It is designed for the exact problem that every Canton operator running Fireblocks will face.
That is why the External Signer is essential for any institution serious about production Canton infrastructure.
