Reading mint authorities on Solana

2026-11-04 UTC · Farbeam research

Every SPL token on Solana has a mint account. That account stores the supply, the decimals and two optional keys: the mint authority and the freeze authority. Reading them takes one call. Knowing what they mean takes more thought, and this guide covers both.

#The two authorities

Revoking is permanent for the classic SPL mint: once a field is null, no one can set it again. A frozen account cannot send tokens, so a live freeze authority on a small token can stop holders from selling.

#Read it yourself

You do not need Farbeam for this. Any Solana RPC can answer.

curl -s https://api.mainnet-beta.solana.com -X POST -H "content-type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"getAccountInfo","params":["JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN",{"encoding":"jsonParsed"}]}' | jq '.result.value.data.parsed.info'

The response includes decimals, supply, mintAuthority and freezeAuthority. Check that data.parsed.type is mint. A normal wallet address does not have this shape.

#Read it through the report

The token report returns the same fields with a status, and the address that holds the authority.

curl -s "https://farbeamlabs.com/api/v1/tokens/solana/JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN" | jq '.data.checks[] | select(.id | test("authority"))'

const mint = "JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN";
const { data } = await (await fetch(`https://farbeamlabs.com/api/v1/tokens/solana/${mint}`)).json();
console.log(data.checks.filter((c) => c.id.includes("authority")));

import requests

mint = "JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN"
data = requests.get(f"https://farbeamlabs.com/api/v1/tokens/solana/{mint}", timeout=30).json()["data"]
print([c for c in data["checks"] if "authority" in c["id"]])

The check reads pass if the authority is revoked, warn if it is set and unknown if the mint data did not arrive. A set authority is a warn and not a fail because it has many valid uses.

#Real examples

Read on 2026-11-04 between 19:46:04Z and 19:47:42Z. More are in authorities in major Solana mints.

#How to think about a set authority

First identify the type of token, then ask whether the authority fits.

Then look at who holds the authority. These are the usual options, with the question each one raises.

The report gives the address and no more. Use the wallet explorer to look at it. Solana recent signatures come back with the wallet result.

#What a revoked authority does not mean

Revoked is a good thing to confirm, but it is one fact. It does not mean:

• Supply is widely held. JUP had 65.2% in its 10 largest token accounts in the same snapshot, and RAY had 77.6%, both with revoked authorities. Vesting vaults and pools count in those figures.
• Liquidity is safe. A pool owner may still be able to withdraw.
• The token cannot lose value.

#Token-2022 adds more powers

The newer Token-2022 program can add extensions, such as a permanent delegate that can move any holder's tokens, or transfer hooks and fees. A mint can have revoked classic authorities and still have these. The report reads closable and balance_mutable_authority from GoPlus. It does not cover every extension, so read the mint's extensions directly for a Token-2022 token.

#Limits of this check

• The report caches mint data for 5 minutes.
• getTokenLargestAccounts can fail on very large mints. Then top10 reads unknown, as it did for USDC and USDT in this snapshot.
• The check makes no statement about whether a holder of an authority will act.
• It is not financial advice.