Skip to main content
The QUIC lane is Hofund’s lowest-overhead ingress: a persistent UDP connection to the node, one bounded control-stream authentication, then one unidirectional stream per transaction, and no application response. It is for clients that already reconcile by signature and want to skip HTTP and Bifrost key-path handling.

​
Endpoint

The standard bearer-authenticated ingress is available at these production endpoints: The lane is fixed by the port; nothing on the wire selects it. The dashboard lists Endpoints → Hofund → QUIC ingress only when that account already has its usable Bifrost key. Use the endpoint shown there; a location that is not listed for the selected account is not available to that account.

​
Authentication

Authentication is your per-pass Bifrost key, and only that key — the same credential you use on every other Hofund route:
  • The server presents the location’s public certificate (issued by Let’s Encrypt). Your client verifies it by the location host as the server name, against your system roots or ISRG Root X1, on every connection.
  • Immediately after connecting, open one bidirectional control stream and send exactly this JSON:
  • After writing the JSON, half-close the control stream’s send side (FIN) and keep its receive side open. In quic-go, call stream.Close() after stream.Write(...); keep the QUIC connection open. The server reads through EOF before validating the message. Without FIN, it waits until the 5-second authentication timeout and rejects the connection.
  • Read the server’s {"type":"authenticated"} reply through its FIN before opening transaction streams. On success you keep the connection; on failure it closes with application error 0x102 (authentication failed). An {"type":"auth_failed"} reply is best-effort and may be lost during closure.
Send the key in the control JSON body. It is never sent in an Authorization header, a URL/query string, a JSON or base64 transaction envelope, or a QUIC Initial Token, and none of those are accepted as authentication. A transaction stream opened before authentication succeeds closes the connection.

​
Wire contract

  • QUIC v1, TLS 1.3, ALPN hofund-ingest/1. The client verifies the server’s public certificate by hostname against system roots; no other credential is exchanged.
  • One bidirectional control stream: exactly one bounded authenticate JSON object followed by client FIN; then the authenticated reply followed by server FIN. Complete authentication within 5 seconds.
  • One client-initiated unidirectional stream per transaction. The stream carries the raw, fully signed transaction bytes — 1 to 1232 bytes, no framing, no base64 — followed by FIN.
  • Recent blockhash and caller-owned durable nonce transactions are supported, with the same nonce requirements as HTTP.
  • Datagrams, bidirectional transaction streams, server-initiated streams, 0-RTT, and session tickets are not used.
  • Up to 64 concurrent transaction streams per connection and 10 connections per account. Unauthenticated connections are capped per source IP before a token exists. The server closes a connection idle for 30 s; reconnect and re-authenticate.
  • The same tip rules apply as on the JSON routes: a Thor tip on every transaction. Transactions that fail admission are dropped.
  • Your tier’s rate applies (Rate limits); streams over the rate are dropped without notice — pace your sends.
Nothing is sent back. A stream that closed cleanly means the bytes were handed to Hofund’s transport, not that the transaction was accepted or landed. Send each transaction at most once, then reconcile the signature through ThorEdge RPC. There is no submission id on this lane, so getHofundSubmissionStatus does not apply.

​
Reference client

ThorNode ships a reference client: the hofund-quic-client command and the Go package it is built on. The command reads one raw transaction from a file and reports only what it can know — the transport handoff:
--bearer-token is optional because the command reads HOFUND_QUIC_BEARER_TOKEN; the flag overrides the environment and neither is printed.
Credential paths must be absolute, regular files that only your user (or root) can read; the server CA is the only file. The Go client completes the control-stream authentication during Dial and on every reconnect, keeps one connection open, applies local backpressure at 64 in-flight sends, and never re-sends a transaction whose stream write already started — a failure after that point is reported as ambiguous and must be reconciled, not retried automatically. Any QUIC library that supports ALPN works the same way: connect with hofund-ingest/1, verify the server certificate, send the one control-stream authenticate message and FIN, read the authenticated reply through server FIN, then open a unidirectional stream per transaction with the raw bytes and close it.