Skip to main content
This guide runs an attestor as its own process, serving one chain. A relayer can then query it and count its signatures toward a light client’s quorum.

​
Before you begin

You need:
  • A chain with IBC deployed, and a light client tracking it. This guide continues from the tutorial.
  • Your signing address already in that client’s attestation set.
  • Your signing key.
  • The chain’s RPC endpoint and router address. General configuration validation permits a missing router address, but attestor startup requires it.
  • Go 1.26.10 or later and a build of the binary.
The commands below move the tutorial’s attestor for 41002 into its own process. The Besu client on 41002 verifies chain 41001 without an attestor.
Warning: Stop the tutorial’s relayer with Ctrl+C in its terminal. It hosts the attestor that this guide moves into a separate process.

​
1. Attestor config

Create a second configuration file alongside the tutorial’s:
It shares the tutorial’s keystore, so the attestor key generated there is already available. That key’s address matches the one in the client’s attestation set.
Use separate keys for independent clients and chains. Signatures are not bound to a chain, router, or verifying client.

​
2. Write its configuration

Write the attestor’s configuration file, reading the router address from the deployment:
This guide names each attestor attestor-<chain it watches>. Names must be unique within the serving process.
Warning: The attestor’s name has to match the name the relayer uses for it. A relayer sends that name in every query, and the process serves its attestors by name, so a mismatch makes every lookup fail.
A finality offset of 1 signs one block behind the chain head. Zero waits for the chain’s own finalized block instead.

​
3. Start it and verify

  1. Validate the configuration:
  1. Start the process in a new terminal, and leave it running:
That readiness line names the address it bound.
  1. Back in your first terminal, ask the process what its address is:
This should be the address of the attestor.
  1. Ask how far it can attest:
This shows the attestor’s latest height.

​
Connect a relayer

A relayer references your attestor by name and network address:
If the attestor is served behind TLS, write its address as https://host, which uses port 443 unless you add one, and add a tls block for a private CA or mTLS, as described in TLS for remote services.

​
Next steps