Boltwall primary sources — 2026-05-03

Project status in this pass

• No canonical standalone Boltwall whitepaper or litepaper surfaced.
• The clearest current source of truth is the canonical GitHub README, the official GitHub Pages docs, and Tierion’s LSAT explainer.
• Boltwall is best understood as reusable Lightning-paid API middleware built around LSAT-compatible authentication rather than as a standalone protocol.

Primary-source snapshots

1) Canonical repository / README

• URL: https://raw.githubusercontent.com/Tierion/boltwall/master/README.md
• Key excerpt:
  • The README describes Boltwall as “Bitcoin Lightning paywall and authentication using LSATs.”
  • It says developers can “charge to access your API without requiring user accounts, API keys, credit cards, or storing any user data.”
  • It also says the paywall can be added with a single middleware line: app.use(boltwall()).

2) Official docs site

• URL: https://tierion.github.io/boltwall/
• Key excerpt:
  • The docs walk through a flow where a protected route returns 402 Payment Required and a WWW-Authenticate LSAT challenge, the client pays the invoice, and then retries with an Authorization: LSAT ... header.
  • They document prebuilt caveat configs for time-based access and origin/IP restriction.
  • They also document HODL-invoice support and explicitly say a held invoice can count as paid authorization state.

3) Tierion LSAT explainer

• URL: https://blog.tierion.com/lsats-authentication-using-bitcoin-lightning-payments/
• Key excerpt:
  • Tierion says it built Boltwall in 2019 as middleware for Lightning-powered paywall servers and later migrated it toward LSAT compatibility while working with Lightning Labs.
  • The post frames Boltwall as one component in a broader LSAT toolkit alongside lsat-js, now-boltwall, and an LSAT playground.
  • It also explains Chainpoint’s machine-to-machine payment flow and highlights Boltwall’s HODL-invoice support for single-use or state-tracked authorization.

4) Repository landing page

• URL: https://github.com/Tierion/boltwall
• Key excerpt:
  • The repository landing page repeats the same core positioning: Lightning paywall and authentication, LSAT-based access control, and drop-in middleware for API routes.
  • Its surfaced section headings reinforce the implementation focus on caveats, HODL invoices, and route protection rather than on a separate token or chain protocol.

Working conclusion

Boltwall is best cataloged as Lightning-paid API and route-protection middleware. The deciding evidence in this pass was the combination of one-line Express integration, explicit 402 + WWW-Authenticate challenge handling, caveat-based macaroon restrictions, and native HODL-invoice workflows for more stateful authorization patterns.