Blockstream Enterprise Custody SDK
Getting Started

Environments

AMP2 uses separate infrastructure for testing and production. Testnet and mainnet use separate Liquid networks, credentials, and server URLs.

AMP2 runs on separate infrastructure for testing and production. Both environments expose the same API surface, but operate on different Liquid networks with different credentials.

Testnet

PropertyValue
Base URLhttps://amp.enterprise.blockstream.com/
Liquid networkLiquid Testnet
AMP2 keyorigin xpubProvided during onboarding (included in invite data)
LBTCFree testnet LBTC (from faucet)
PurposeIntegration development, flow validation

Use testnet for all development and QA work. Assets issued on testnet have no monetary value and the environment can be reset independently of production.

Mainnet

PropertyValue
Base URLProvided during issuer onboarding
Liquid networkLiquid Mainnet
LBTCReal LBTC (pegged from Bitcoin)
PurposeProduction asset operations

Only use mainnet after completing security review, key management setup, and full end to end testing on testnet.

Invite data

TODO: Show image of invite data

Before you can authenticate with the SDK, you need invite data from Blockstream. The invite payload contains:

FieldDescription
device_uuidUnique identifier for this device/integration
invite_stringOne time string consumed during account activation
One time private keyHex encoded key used to sign the initial authorization request
Server RSA public keyPEM encoded RSA key for encrypting requests to AMP2
Server ECDSA public keyCompressed hex P-256 key for verifying AMP2 responses
API base URLThe AMP2 server URL for this environment

Invite data is typically delivered via a secure URL. Each invite is single use: once the authorization call succeeds, the one time key is consumed and cannot be reused.

Access model

The SDK packages (@blockstream/cryptic, @blockstream/ecs-registry, @blockstream/amp-registry) are private. To get access:

  1. Contact Blockstream to request issuer onboarding.
  2. Receive npm registry credentials or a scoped access token.
  3. Configure your .npmrc with the registry URL and auth token.
  4. Receive invite data for your target environment (testnet first, mainnet after validation).

Environment differences

AspectTestnetMainnet
xpub derivation pathsTestnet BIP paths (87h/1h/0h)Mainnet BIP paths (87h/0h/0h)
LBTC fundingFaucetsReal BTC peg in
Asset persistenceMay be resetPermanent
COSE encryptionEnabledEnabled

Caution: Never use testnet keys, credentials, or invite data on mainnet, and vice versa. The xpub derivation paths differ between networks, and mixing them will produce invalid descriptors.

Next steps

On this page