canton-network-docs/Wallet GatewaySet up & operate
Troubleshooting
Common issues you may hit when running the Wallet Gateway, with fixes.
Database connection errors
The Wallet Gateway fails to start with database connection errors.- PostgreSQL: verify the database exists (
psql -U postgres -l), check credentials in your config, ensure PostgreSQL is running (pg_isready), and check network and firewall rules. - SQLite: ensure the directory for the database file exists, check read/write permissions, and verify disk space.
- Memory: no configuration is needed, but remember data is lost on restart.
Authentication failures
API calls return401 Unauthorized.
- Invalid or expired token: use a valid JWT, check its expiration, and regenerate it if needed.
- Missing Authorization header: include
Authorization: Bearer <token>in the correct format. - Session not found: create a session with
addSession()first, ensure it has not expired, and confirm you are using the correct user context.
Network connection issues
The Wallet Gateway cannot connect to a configured network or Ledger API.- Network unreachable: verify the Ledger API URL, test connectivity with
curl <ledger-api-url>/v2/version, and check firewall rules and routing. - Invalid network configuration: confirm
synchronizerIdmatches the validator, theidentityProviderIdmatches an IDP, and the credentials are correct. - SSL/TLS issues: verify certificates for HTTPS endpoints. In development you may need HTTP or to configure certificate trust.
Port already in use
EADDRINUSE: address already in use :::3030.
-
Find and stop the process using the port:
-
Use a different port:
-
Check whether another Wallet Gateway instance is running:
Configuration validation errors
The Wallet Gateway fails to start with configuration errors.-
Validate your config against the schema:
- Check for common mistakes: missing required fields, invalid JSON, type mismatches (strings vs numbers), and incorrect IDP references in networks.
-
Start from the example config:
Signing provider issues
Transactions fail with signing errors. Verify the provider’s environment variables and permissions:- Fireblocks:
FIREBLOCKS_SECRETandFIREBLOCKS_API_KEYset, keys valid with proper permissions, and the Fireblocks API reachable. - Participant: the participant node is running and reachable, the party exists on it, and the participant logs show no signing errors.
- Blockdaemon:
BLOCKDAEMON_API_URLandBLOCKDAEMON_API_KEYset, API reachable, and the key has signing permissions. - DFNS:
DFNS_ORG_ID,DFNS_BASE_URL,DFNS_CRED_ID,DFNS_PRIVATE_KEY, andDFNS_AUTH_TOKENset, credentials correct, and the service account has wallet-creation and signing permissions.
Debugging
-
Enable pretty logs for readable, detailed output:
-
Use structured logs for aggregation:
- Check logs in console output, system logs, or container logs depending on how you run the Wallet Gateway.
-
Verify endpoints respond: