How it works and safety

Two rules and a clock.

Keysfirst doesn't decide any deal. A public program on Solana applies the same rules to every deal: only the tenant's approval at the handover pays the landlord. Otherwise the deposit goes back to the tenant: the landlord can return it at any time, and after the deadline anyone can.

A deal, start to finish

Step 1
Done: The landlord creates the deal
Room, amount, move-in and the latest handover, at most 14 days after move-in.
Step 2
Done: The tenant pays into the lock
The exact amount, before the deadline.
24 h before move-in
Now: The handover window opens
From now until the deadline, the tenant can release the deposit.
At the door
Next: The tenant scans the landlord's code
The whole deposit goes to the landlord, in seconds.
After the deadline
Later: No handover?
The whole deposit goes back to the tenant. Anyone can trigger it.

Released to landlord

When the tenant scans the landlord's code at the handover and taps “I have the keys”.

Returned to tenant

When there's no handover by the deadline, or the landlord gives the deposit back earlier.

The rules

Who can do what, and when.

1Only the landlord can create a deal, and they can cancel it until someone pays.
2The tenant pays the exact amount into the lock, before the deadline. The landlord can't pay their own deal.
3Paying only works if the money would be locked for at most 180 days.
4Only the tenant who paid can release the deposit to the landlord, from 24 hours before move-in until the deadline.
5The landlord can give the deposit back to the tenant at any time.
6After the deadline, anyone can send the deposit back to the tenant.
7Every deal settles once. The money only ever goes to the tenant or the landlord, and the deal stays on Solana as a receipt.

What if…

Every hard question has a rule behind it.

What if the landlord is fake?
Nobody can hand you real keys, so you never scan and the fake landlord is never paid. After the deadline you can take the deposit back.
The rule: Only the tenant's approval at the handover pays the landlord.
What if the room isn't as described?
Don't scan. Ask the landlord to give the deposit back, which they can do at any time, or wait for the deadline and take it back.
The rule: No approval, no payment. The landlord can always give it back.
What if I can't travel?
The deposit stays in the lock, and after the deadline you can take it back. The landlord can also give it back earlier.
The rule: After the deadline anyone can send the deposit back to the tenant.
What if the tenant never shows up?
The deposit goes back to them after the deadline. You lose the time the room was reserved, not money.
The rule: After the deadline, anyone can send the deposit back to the tenant; nobody has to decide.
What if someone asks me to scan before I arrive?
Don't. Scanning pays the landlord. Only scan standing in the room with the keys; the handover can't even start earlier than 24 hours before move-in.
The rule: The release only works from 24 hours before move-in until the deadline.
What if I scan while logged in with the wrong account?
Nothing moves. Only the account that paid can confirm; log in with that account and scan again.
The rule: Only the tenant who paid can confirm the handover.
What if the landlord takes the money and keeps the keys?
At the door you scan first, so this is possible. It would be theft by a known person at a real address, which is far rarer than an anonymous online scam and easier to act on.
The rule: Keysfirst can't see the physical world. This is a known limit.
What if the landlord wants to call it off?
Before anyone pays, the landlord can cancel the deal. After payment, they can give the deposit back at any time.
The rule: The landlord can cancel an unpaid deal or give the deposit back.

Design choice

Why there's no judge in the middle.

Software can't see whether a room exists, and a judge chosen by the landlord could be the scammer's friend. The only reliable witness is the tenant standing in the room.

So only the tenant's approval pays the landlord, and without it the deposit goes back to the tenant: after the deadline anyone can send it back, or the landlord returns it earlier. The worst case for an honest landlord: a tenant who never comes gets their deposit back, and the landlord loses time, not money.

Honest limits

What Keysfirst doesn't do (yet).

This is a prototype. Here is everything we know it can't protect against.

Someone pressured into scanning from far away close to move-in can still be tricked. The 24-hour rule and clear messages reduce this risk; they don't remove it.
At the door the tenant scans first, so a landlord could take the money and keep the keys. That would be theft by a known person at a real address, far rarer than the anonymous online scam.
A fake copy of this website isn't covered. A verified domain is on the roadmap.
Keysfirst proves the room exists and the keys work, not that the person may legally rent it out. Landlord verification is on the roadmap.
Disputes after move-in, such as damage, are ordinary tenancy law.
A tenant who doesn't show up gets the deposit back; the landlord loses only the time the room was reserved.
On devnet the program can still be updated by its deploy key. Before real money it would be frozen or controlled by several people.
How the service would be regulated hasn't been assessed yet.