Docs/Reference/Admin controls

Admin controls

How Loyfin separates immutable issuer identity from owner-controlled settings, metadata, royalties, and capability flags.

Issuer and owner#

Brand identity and admin control are intentionally separate.

The issuer is the immutable brand identity for a Loyalty Token. It signs issue and redeem actions forever, and Loyfin.getLoyalty(issuer, loyaltyId) remains keyed by that issuer. The owner is only the admin for settings.

Mutable settings#

  • issuable, redeemable, and transferable control whether each capability is open.
  • Metadata URI overrides, royalty bps, and custom royalty receiver are owner-controlled. Metadata URI overrides are capped at 512 UTF-8 bytes.
  • Admin updates can be direct transactions or owner-signed EIP-712 actions submitted by a relayer.

Transfer and renounce#

transferOwnership moves admin control only. It does not move brand identity, issuer signing authority, existing balances, or the factory mapping. renounceOwnership sets the owner to zero and freezes owner-controlled settings.

Operational guidance#

Brands that need signer rotation should use a multisig or contract wallet as issuer and rotate authorized signers there. Use owner transfer for admin team changes, and use renounce only when the brand is ready to make the current settings permanent.