Complete the signer-capability handoff for an Aptos resource account

A package published through a resource-account deployment flow may need to sign future actions as that account. The deployment container holds the capability until the resource account retrieves it.

Use the resource signer and the original source address

Call the retrieval function during the initializer designed for this deployment flow. The signer belongs to the newly deployed resource account. The second argument identifies the originating account whose Container holds the capability. Define Control in your module to retain it.

let cap = aptos_framework::resource_account::retrieve_resource_account_cap(
    resource_account_signer, source_address
);
move_to(resource_account_signer, Control { cap });

Verify custody before enabling business operations

Retrieval removes the stored entry and rotates the resource account’s authentication key to zero. A second retrieval with the same source will not recreate the capability. Test a restricted method that uses the retained capability to generate a signer, and verify it returns the expected resource-account address. Exposing that signer or capability to arbitrary callers would give them the account’s authority.

Sources