Select the correct signer for a rekeyed Algorand account

An account can keep the same address and funds while another address authorizes its transactions. A signer router that always selects credentials by sender will fail after rekeying.

Inspect the live authorization address

Query algod for the sender account and inspect auth-addr. The excerpt shows a partial illustrative response. When the field indicates B, build the transaction with sender A and route signing to the authorized signer B. When the optional field is absent for an ordinary account, its own address authorizes spending.

GET /v2/accounts/ACCOUNT_A

{
  "address": "ACCOUNT_A",
  "auth-addr": "SIGNER_B"
}

Recheck authorization during signer rotation

If a transaction was built before A rekeyed from B to C but submitted afterwards, the node will evaluate its signature under the effective authorization. Keep transaction sender, signing credential and observed round separately in diagnostics. Changing the sender field to B would spend B’s funds and would no longer represent A’s payment.

Sources