Link a customer account
A custodial distributor ties one of its customer accounts to one Yutai holder with one signed link grant. The distributor's own registered key signs the grant, and the link is what lets the holdings the distributor attests for that account count for the holder. This page shows the message the grant carries and the rules it must meet. The ids and instants travel in the shapes the identifiers page carries.
Yutai does not receive link grants yet. These are the contracts the grant will ride, so what you build against them now stays the same.
The message
The grant is one fixed message the distributor signs. Yutai builds the same text from the same facts, in the same order, so a signature verified over one text is verified over the other: what the distributor signed is what Yutai read.
Yutai venue account link
Tenant: tnt_01J9ZQ4V8W7X6Y5Z4A3B2C1D0E
Venue: tnt_01J9ZQ5B7C8D9E0F1G2H3J4K5M
Holder: hld_01J9ZQ6N8P9Q0R1S2T3V4W5X6Y
Account: acct-1
Issued: 2026-10-08T09:30:00.000Z
Expires: 2026-10-08T09:40:00.000ZThe first line is fixed. The Tenant line names the member the holder belongs to, the Venue line names the distributor's own member id, since a distributor is itself a member of the network, and the Holder line names the holder the account links to. The Account line carries the account reference, and Issued and Expires set the window below.
The account reference
The Account line carries the distributor's own reference for the customer account, one pseudonymous value: 1 to 128 characters of letters, digits, dot, underscore and hyphen. No email address, no phone number: a distributor that would send its customers' contact details is refused rather than trusted not to. Each refusal below reads Yutai's own words for it.
(empty)- Refused:
a user_ref is not empty. acct:1- Refused:
a user_ref carries no colon. ana@example.com- Refused:
a user_ref is pseudonymous, never an email address. 1234567890- Refused:
a user_ref is pseudonymous, never a phone number. acct 1- Refused:
a user_ref is letters, digits, dot, underscore and hyphen only. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa- Refused:
a user_ref is at most 128 characters. acct-1- Accepted. The message's Account line carries it above.
The account line of the grant itself is checked by a wider rule: it allows a colon, and it accepts the digit runs this rule reads as phone numbers. So a reference the rule refuses, one with a colon in it and one that reads as a phone number, rides in a grant the distributor can sign. No holder key names the account such a grant links, so no ledger row keys by it.
The window
The grant carries its own window: the distributor sets Issued and Expires when it signs, and the grant answers only while it stands inside that window. A window runs at most 10 minutes, the maximum the contracts fix; the sample grant above runs exactly that long. A longer window is refused: a link grant stays valid for at most ten minutes.
The signature
The distributor signs the exact message text with the key Yutai holds for the distributor. One scheme is recorded: ed25519, a public-key scheme, so verifying a signature needs only the distributor's registered key and Yutai holds no secret for the distributor.
- The registered public key
- 32 bytes in unpadded base64url, 43 characters. For example
WtTAcVt6sLLyNNMbLG71waqd4xm-PPDE1_KokWDks8k. - The signature
- 64 bytes in unpadded base64url, 86 characters. For example
P5ocflstjwSmwenTt_WiyOTWsPKoxuHT9ae5wOLU9qjx49XHuaHz5dfJsaP159nBs6X36dHDtaf54dPFt6nw4g.
What Yutai does with it
Yutai verifies the signature first, over the exact message text, against the distributor's registered key: the key the submission names by id, or the distributor's first key when it names none. The key must be valid at the grant's issued instant. A grant with no signature, one from a distributor with no registered key, or one whose signature does not verify is refused, and nothing is stored.
A verified grant must be inside its own window when it arrives: one that has not started or has expired is refused. The holder it names must be a holder of the member the grant names. One distributor account stands linked to at most one holder at a time, across every member of the network; a revoked link blocks nothing, so a new grant can link the account to another holder. A grant's signature links at most once: submitting the same signed grant again does nothing, even after the link it made was revoked.
The link gives the account one holder key, the identity the distributor model's ledger keys it by: venue:tnt_01J9ZQ5B7C8D9E0F1G2H3J4K5M:acct-1, built from the grant's own Venue and Account lines.
The submission
Yutai does not receive link grants yet: no route serves them today. The message and its rules above are already the contracts the grant will ride, so what a distributor builds against them now stays the same.