Collection Authority Record

What it is

A Collection Authority Record delegates the power to verify (and unverify) NFTs into a Metaplex collection to an address that isn’t the collection’s update authority. It’s a small permission slip: “this key is allowed to mark NFTs as belonging to my collection.”

Why it exists

Verifying an NFT into a collection normally requires the collection’s update authority to sign. But minting platforms and candy machines need to verify items on the issuer’s behalf without holding the master update-authority key. The record delegates exactly that one capability, scoped to one collection.

Byte layout

CollectionAuthorityRecord is Borsh-encoded. It’s a PDA seeded with the collection mint and the delegated authority.

Total: 35 bytes (1 + 1 + 1 + 32).

Where you see it

Candy Machine and other minting infrastructure that verifies items into a collection at mint time. The existence of this record is what lets a delegated signer call VerifyCollection without being the collection’s update authority.

Common gotchas

• It grants verify rights, not ownership. The delegate can verify/unverify collection membership; it can’t change the collection’s metadata or transfer the collection NFT.
• Revocable. The update_authority that created the record can revoke it (closing the account), instantly removing the delegate’s power.
• Stores its own bump. The bump field caches the canonical bump so the program doesn’t re-derive it each call — a common pattern in small Metaplex records.
• Superseded by MetadataDelegate in newer flows. Recent Metaplex versions favor the generalized MetadataDelegate (key 12) record; CollectionAuthorityRecord (key 9) remains common on existing collections.