Signer Types

Use this page to compare signer capabilities and supported chains. See Signers for day-to-day wallet control and Recovery Methods for changing wallet control.

​

Capability Matrix

​

Device Signer

The device signer generates a P256 keypair inside the device’s secure enclave — such as iOS Secure Enclave, Android Keystore, or a browser-based credential store. The private key stays inside the hardware security boundary. The device signer is the default for client-side wallets. Each device gets its own signer, and device signers are not synced or portable across devices. Signing is silent or uses an optional biometric prompt.

​

Passkey Signer

Passkeys use the WebAuthn standard to create a hardware-backed credential that can sync across devices through the platform’s passkey provider, such as iCloud Keychain or Google Password Manager. Passkey signers are available only on EVM chains. Each signing operation requires biometric or PIN authentication. If a wallet has multiple passkeys, specify the passkey id; a single passkey is selected automatically.

​

Server Signer

A server signer is backed by a secret held in your infrastructure. The secret deterministically derives keypairs by chain type. The same secret produces one signer address across EVM chains within a project and environment, with separate addresses for Solana and Stellar. Server signers are designed for backend applications, treasury wallets, and AI agents. Signing happens in process without external calls. See the server-side quickstart for a server-only wallet.

​

Email OTP Signer

The email OTP signer sends a one-time code to the user’s email address. The user enters the code to authorize the operation. Email OTP uses a familiar authentication pattern and works across supported chains.

​

SMS / Phone OTP Signer

The phone OTP signer sends a one-time code by SMS or WhatsApp. The user enters the code to authorize the operation. Phone OTP works across supported chains.

​

External Wallet Signer

The external wallet signer delegates signing to a wallet the user already controls, such as MetaMask or Phantom. The user provides the wallet address and a signing callback. The callback receives a chain-specific payload: a hex string for EVM, a VersionedTransaction for Solana, or a string payload for Stellar.

​

Cloud KMS Signer

A Cloud KMS signer uses a non-extractable key stored in AWS KMS, Azure Key Vault, or GCP Cloud HSM. The private key stays inside the cloud provider’s hardware security module. Cloud KMS signers provide cloud IAM controls, audit logging, and optional multi-party approval. They are designed for company wallets, treasury operations, and custodial architectures controlled by your infrastructure. See the Cloud KMS implementation guide.

​

See Also