Validators / Provers / Independent operators
Run an SOS validator or privacy prover
Validators and provers perform different jobs. Validators execute consensus and verify transactions and receipts. Privacy provers generate expensive STARK receipts from private witnesses. One machine may run both roles, but the trust, capacity, and exposure requirements are not the same.
Signed testnet releases are distributed through the public sos-node repository.
Validator
Consensus and proof verification
Prover
Local STARK generation
Witness policy
Keep on controlled infrastructure
Authentication
Local bearer token
Choose the role deliberately
A validator maintains chain state, participates in consensus when registered, exposes the configured RPC surface, and verifies proof-carrying transactions. A prover receives a private witness from its owner, generates a receipt, and returns that receipt to the wallet. It does not need validator authority.
The Windows setup wizard can configure validator-only or validator-plus-prover operation. When the prover is created, its bearer token must be copied into the wallet's Prover settings before continuing. The token is an authentication secret, not a blockchain key.
Protect the prover boundary
A browser must be able to reach the configured prover URL, but the service should not be opened broadly to the internet. Use loopback for a prover on the same PC, or authenticated TLS and strict network controls for a prover on another machine you control.
- Never put the bearer token in source control, screenshots, support messages, or public logs.
- Back up validator keys and configuration separately from wallet recovery phrases.
- Verify release checksums and signatures before starting a downloaded binary.
- Monitor disk, memory, peer count, height, proof queue, and restart behavior.
Capacity and queueing
Proof generation is intentionally more expensive than transparent validation. Under load, proof-dependent transactions should remain queued rather than being silently discarded, while transparent validation continues. Additional independent provers improve throughput without expanding validator authority.
Questions
Common questions
Must every validator also be a prover?
No. Validators verify receipts. A separate user-controlled prover can generate the receipt, and one operator can choose to run both services.
Where does the prover bearer token appear?
The installer or first-start flow prints it when the prover service is created. It should be copied once into the wallet's Prover settings and stored as a secret.
Can I use a public third-party prover?
That would disclose the spend witness to its operator. Use a prover on infrastructure you control unless a future delegated-proving design explicitly changes that trust model.
Primary sources
Last reviewed: 2026-07-21