Gateway

safe-gateway is the coordination layer for HypeSafe.

It exposes the API used by the frontend and by optional safe-node instances. It keeps the shared read model for accounts, tasks, signatures, rejection votes, and execution history.

The gateway is intentionally keyless. It coordinates the workflow, verifies authorization, and records state, but it does not become an owner of the multisig account.

Responsibilities

• Authenticate users and nodes through wallet-signature sign-in and short-lived JWT sessions.
• Track multisig account state and each signer's account list.
• Register task templates and expose their UI projection.
• Build the exact EIP-712 payloads that signers approve.
• Verify submitted signatures by recovering the signer address.
• Count approvals and rejection votes against the configured multisig signers.
• Mark tasks executable when the threshold is met.
• Provide outer execution payloads to the leader.
• Store execution results written back by the frontend or a leader node.

Boundary

The gateway does not hold private keys. It does not sign, approve, or submit on behalf of users. Its approval count helps the team know when a task is ready, but Hyperliquid still validates the final multisig action at execution time.

If a submitted signature cannot be recovered to an authorized signer, it does not count. If the threshold is not met, the task is not executable through the normal workflow.

API Consumers

• The frontend calls the gateway through same-origin /api/* routes.
• safe-node calls the same business API directly from the local service.

Using the same API keeps manual approvals and automated node approvals in one task history.