InvalidTransactionSourceAccountException

Exception thrown when the challenge transaction's source account is not the server account.

SEP-10 Security Requirement: the challenge transaction returned by the web auth endpoint MUST have its source account set to the Server Account, that is the SIGNING_KEY published in the server's stellar.toml.

The source account is distinct from the operation source accounts: the first operation is sourced by the client account, while the transaction itself is sourced by the server. A challenge whose transaction source is some other account is not a challenge this server issued for this flow, so it is rejected before any signature work.

Muxed (M...) source accounts are rejected by the same comparison, since the Server Account is an ed25519 account id.

Parameters