Domains and environments

Salt uses environment-specific domains.

This page is a quick reference for how Salt treats privileged Salt domains and tenant domains.

Domain types

Domain type	Meaning	Typical use
Privileged Salt domain	A Salt-operated domain where Salt is used in a privileged context	Direct Salt access, SDK usage under the Salt tenant, organisation setup, account setup, Robo Guardian setup, and sensitive Salt-controlled workflows
Tenant domain	A registered third-party application domain using Salt through the SDK	Embedded applications that need tenant-specific data separation and their own user-facing domain

Current environments

Environment	Privileged Salt domain	Notes
SDK testnet	testnet.salt.space	Used to test SDK features
Production	To be confirmed	Used for production Salt integrations

Do not assume that production domains are available in testnet, or that testnet domains have production access.

Privileged Salt context

When you use a privileged Salt domain, you are using Salt in a privileged context.

This can include direct use of Salt-operated applications, or SDK usage where the session is authenticated against the Salt tenant rather than a third-party tenant.

A privileged Salt context may be used for workflows such as:

• creating organisations
• creating accounts
• setting up Robo Guardians
• retrieving Robo Guardian configuration
• accessing sensitive Salt-controlled setup flows
• providing continuity if a third-party application becomes unavailable

Robo Guardian configuration endpoints are only available to sessions authenticated in a privileged Salt context.

Tenant context

A tenant domain is used when a third-party application wants its own application context.

For example, a fintech building a web app on Salt should use a registered tenant domain. This gives the application tenant-specific data separation and prevents organisations created through one tenant from being automatically visible inside another tenant.

You can use the Salt SDK without registering your own tenant by using Salt in a privileged context. To build a third-party web application with its own tenant boundary, the application must use a registered tenant domain.

Contact Salt to register a tenant domain.

Authentication scope

Salt authentication is domain-aware.

When a user signs in, Salt uses Sign-In with Ethereum (SIWE) to bind the authentication message to the domain being used.

After authentication, Salt issues a JWT scoped to:

• the authenticated EOA
• the tenant context

This means the same EOA can authenticate to multiple Salt-powered applications without automatically exposing data from one tenant context inside another.

SDK testnet notes

For the SDK testnet release:

• use testnet.salt.space for privileged Salt context
• use only tenant domains registered for the testnet environment
• do not hardcode production domains
• use the environment-specific API and authentication configuration supplied for the release