Agent Wallets and Key Management

Question 1

What is a server wallet for AI agents?

Accepted Answer

A server wallet is a wallet your backend controls through an API, with its keys held by infrastructure rather than on a user's device. It suits AI agents, which run on servers. Good designs keep keys inside a secure environment, such as a trusted execution environment, so they are never exposed to your application in plaintext.

Question 2

What is a smart wallet?

Accepted Answer

A smart wallet is a crypto wallet whose account is a smart contract instead of a single private key. The contract's code sets the rules, so it can support several signers, passkeys, recovery, spending limits, batched transactions and gas paid by someone else. On Ethereum, smart wallets build on ERC-4337 or EIP-7702.

Question 3

What is a self-custodial wallet?

Accepted Answer

A self-custodial wallet is one where you, not a company, control the keys that move the funds. Nobody can freeze or move your assets without your keys, but you are also responsible for keeping them safe, and losing them can mean losing access. Wallet providers in this model never take custody of your funds.

Question 4

How do you recover a crypto wallet without a seed phrase?

Accepted Answer

Use a wallet whose recovery does not depend on one memorized phrase, such as a smart account with guardians or a wallet backed by passkeys or split keys. Our post covers the recovery options.

Question 5

What is a web3 wallet?

Accepted Answer

A web3 wallet is an app or device that lets you hold, send and receive cryptocurrency and sign in to blockchain apps. It does not store the coins themselves; it holds the keys that control your account on the blockchain, and uses them to sign transactions and messages you approve.

Question 6

How do you give an AI agent a wallet?

Accepted Answer

Give it a wallet it cannot drain: a smart account or server wallet with its own key, an identity, a spending cap and allowed destinations enforced outside the agent. Our post walks through building one.

Question 7

Custodial vs non-custodial wallets for AI agents: which is safer?

Accepted Answer

Neither is safer by default. A custodial wallet puts a provider's security and controls in charge, which suits regulated or high-value use. A non-custodial wallet keeps control with the owner but makes them responsible for the keys. For agents, what matters most is that spending limits are enforced where the agent cannot change them.

Question 8

How do AI agents sign transactions without exposing private keys?

Accepted Answer

The key stays somewhere the agent's code cannot read it. Common designs keep it in a trusted execution environment or split it across parties with multiparty computation, and the agent requests signatures through an API. Smart accounts add limited session keys, so even a leaked agent key has bounded power.

Question 9

What is an embedded wallet?

Accepted Answer

An embedded wallet is a wallet built into an app, created when a user signs in with familiar methods such as email or social login, with no separate wallet app or seed phrase. The app's wallet provider manages keys and recovery behind the scenes, while the user approves transactions inside the app.

Question 10

What is embedded wallets as a service?

Accepted Answer

Embedded wallets as a service means a provider supplies the wallet infrastructure, including key management, signing, recovery and APIs, so an app can create wallets for its users without building any of it. The app keeps the user experience; the provider runs the security-critical parts.

Question 11

Are non-custodial embedded wallets really non-custodial?

Accepted Answer

It depends on who can sign. If the user's authentication is required for every signature and the provider cannot sign alone, control stays with the user. If the provider or the app can move funds without the user, it is custodial in practice, whatever the marketing says. Ask how keys are split, stored and recovered.

Question 12

What is wallet as a service (WaaS)?

Accepted Answer

Wallet as a service (WaaS) is infrastructure that lets a business create and manage crypto wallets through APIs: key generation and storage, transaction signing, recovery and policy controls. The business decides who controls the wallets, its backend or its users, and the provider operates the underlying key management.

Question 13

How does a web3 wallet work?

Accepted Answer

It manages the keys for your blockchain account. When you send funds or use an app, the wallet builds the transaction, asks you to approve it, signs it with your private key and broadcasts it to the network. Your balance lives on the blockchain, and the wallet reads it from there.

Question 14

Are web3 wallets safe?

Accepted Answer

They can be, but the risks shift to the user. Transactions cannot be reversed, and losing your keys or recovery phrase can mean losing access for good. Store recovery details offline, check what you are signing, and use wallets with recovery options or hardware protection for larger amounts.

Question 15

What is a smart contract wallet?

Accepted Answer

A smart contract wallet is a wallet whose account is a smart contract. Its code decides which signatures or conditions approve a transaction, so it can require several signers, use passkeys, add spending limits or allow recovery. On Ethereum it is an account abstraction wallet, built on standards such as ERC-4337.

Question 16

What is an MPC wallet?

Accepted Answer

An MPC wallet uses multiparty computation to split signing between several parties, so no single party ever holds the complete private key. A threshold of parties must cooperate to sign, which removes a single point of failure. NIST describes threshold schemes as using MPC to distribute trust in cryptographic operations.

Question 17

What are embedded wallets in digital asset infrastructure?

Accepted Answer

In digital asset infrastructure, embedded wallets are the wallet layer built into a product: accounts created at sign-up, keys handled by the provider's infrastructure and transactions approved inside the app. They let businesses offer crypto features without asking users to install a separate wallet.

Question 18

How do embedded wallets work for crypto custody?

Accepted Answer

Custody depends on the key setup. In user-controlled designs, the key is split or sealed so that only the authenticated user can approve a transaction, and the provider cannot sign alone. In developer-controlled designs, the business's backend controls signing. Recovery runs through the provider's process instead of a seed phrase.

Question 19

How do you implement embedded wallets securely?

Accepted Answer

Choose a provider whose keys stay in secure hardware or are split by multiparty computation, require strong user authentication such as passkeys for signing, test recovery flows, and set transaction policies. Keep API secrets server-side, limit who can export keys, and log every signing request for review.

Question 20

What makes self-custody wallet payments safer?

Accepted Answer

Control stays with the owner, so no intermediary can freeze, misuse or lose the funds in a breach of its own. Payments are signed by the owner's key and settle directly onchain. The trade-off is responsibility: the owner must protect the keys and check each transaction, because onchain payments cannot be reversed.

Question 21

How do you build a custodial wallet?

Accepted Answer

You need secure key generation and storage, such as hardware security modules, multiparty computation or trusted execution environments, plus transaction signing services, policy controls, monitoring and recovery. Holding customers' funds also brings regulation: in the US, hosted wallet providers that transmit value are generally money transmitters under FinCEN rules.

Question 22

How do passkey wallets work?

Accepted Answer

A passkey wallet uses a passkey, a FIDO credential stored on a phone, computer or security key, as the signer instead of a seed phrase. The user approves transactions with a fingerprint, face or device PIN. Some smart accounts, such as Coinbase Smart Wallet, accept passkey keys directly as owners.

Question 23

What is a TEE-based signer and why does it matter for agents?

Accepted Answer

A TEE-based signer keeps private keys inside a trusted execution environment, an isolated part of a processor that even the server's administrators cannot read. Keys are used for signing only inside it. For agents, that means the agent can request signatures without ever being able to read or leak the key itself.

Question 24

How do you export keys from an embedded wallet?

Accepted Answer

Through the provider's export flow, if it offers one. Well-designed exports are end-to-end encrypted between the user and the secure environment, so the application never sees the raw key; some providers restrict exports of user wallets to a secure, isolated interface and require explicit permission for backend exports.

Question 25

Should an AI agent and its user share a wallet?

Accepted Answer

Usually not. A shared wallet gives the agent the user's full authority and makes it hard to tell who did what. Give the agent its own account or a session key with limited permissions instead, funded with what it needs, so the user's main funds stay out of reach and can be revoked independently.

Question 26

How do you rotate or revoke an AI agent's signing key?

Accepted Answer

With a smart account, add the new key as an authorized signer, move permissions to it and remove the old one, all in transactions the owner approves. For limited session keys, let them expire and issue new ones. If a plain EOA key is compromised, it cannot be rotated: move the funds to a new account.

Question 27

What is a social login wallet?

Accepted Answer

A social login wallet creates a crypto wallet when a user signs in with an existing account, such as Google, Apple or email, without a seed phrase. The provider ties key access to that login, often alongside a PIN or recovery questions, so the user can sign in again on another device to regain access.

Question 28

How do embedded wallet providers compare for AI agent use cases?

Accepted Answer

Compare who can sign without the user, where keys live, how recovery works, which chains and account types are supported, whether smart accounts and gas sponsorship are available, what policy controls exist for spending and destinations, and how keys can be exported. For agents, policy enforcement outside the agent matters most.

Question 29

Smart contract wallet vs EOA: what is the difference?

Accepted Answer

An EOA is controlled by one private key; a smart contract wallet is controlled by code, which can add multiple signers, recovery, batching and sponsored gas. Our post covers how the two shape onboarding.

Question 30

Custodial vs self-custodial wallets: what is the difference?

Accepted Answer

In a custodial wallet, a provider such as an exchange holds the keys and moves funds on your instruction. In a self-custodial wallet, you hold the keys and nobody else can move the funds. Custodial means trusting the provider; self-custodial means taking on responsibility for the keys yourself.

Question 31

How does wallet as a service work?

Accepted Answer

The provider runs key management and signing infrastructure behind an API. Your app calls it to create wallets for users or for its own backend, request signatures, apply policies and handle recovery, while keys stay in secure hardware or are split across parties. You build the product on top without operating the cryptography.

Question 32

MPC wallet vs smart contract wallet: which is better?

Accepted Answer

Neither is better in general; they solve different problems. An MPC wallet splits one key across parties offchain, so it works on any chain but its rules live in the provider's software. A smart contract wallet enforces rules onchain, such as limits and recovery, but only on chains that support it. They can be combined.

Question 33

MPC vs TEE signing: what is the difference?

Accepted Answer

MPC splits a key between several parties, so signing needs cooperation and no single party ever holds it. A TEE keeps the whole key inside isolated hardware that even the operator cannot read. MPC spreads trust across parties; a TEE concentrates it in the hardware and its attestation. Some systems use both.

Question 34

What is a programmable wallet?

Accepted Answer

A programmable wallet is one that software can create and operate through an API, and whose behavior can be governed by rules: who may sign, which transactions are allowed, spending limits and automation. It is the kind of wallet businesses and AI agents use, since actions happen in code rather than a wallet app.

Question 35

User-controlled vs developer-controlled wallets: what is the difference?

Accepted Answer

In a user-controlled wallet, the user authenticates and approves each transaction, and the app cannot move funds alone. In a developer-controlled wallet, the business's backend creates the wallets and signs transactions on users' behalf, suiting payouts and automation. The difference is who can authorize a transaction.

Question 36

Can a business own the wallets its AI agents use?

Accepted Answer

Yes. With developer-controlled or server wallets, the business's backend creates and controls the wallets its agents use, and each agent can be limited to its own wallet or session keys with set permissions. The business remains accountable for the funds and the agents' actions.

Question 37

How do you fund an AI agent's wallet?

Accepted Answer

Send funds to its address from a business wallet, an exchange or an on-ramp, in the token and on the network it pays with. Fund only what it needs for a period, top it up on a schedule or when the balance runs low, and keep the main treasury in a separate wallet the agent cannot reach.

Question 38

How do you withdraw funds from an AI agent's wallet?

Accepted Answer

The owner, not the agent, should initiate withdrawals. With a smart account or developer-controlled wallet, the owner signs a transfer back to a treasury address; with session keys, the owner simply revokes them and moves the remaining funds. Restrict the agent itself from sending to addresses outside its allowed list.

Question 39

What is a policy-controlled wallet?

Accepted Answer

A policy-controlled wallet checks every transaction against rules before signing it: spending limits, allowed or blocked destinations, transaction types and approval requirements. The rules sit in the wallet's infrastructure or smart contract, outside the agent's code, so the agent cannot sign anything they forbid.

Question 40

Do AI agents need multi-sig wallets?

Accepted Answer

Not usually for day-to-day spending, which needs to be fast. Multisig suits the treasury that funds agents: a payment needs several owners to approve, as in Safe accounts, which use a threshold of owners. Give agents limited session keys or separate wallets, and keep the larger balance behind multisig.

Question 41

How do embedded wallets handle the travel rule?

Accepted Answer

Mostly through the regulated party in the flow. The travel rule requires money transmitters to pass originator and beneficiary information with qualifying transfers; in the US it applies to virtual currency transfers of 3,000 dollars or more. Hosted wallet providers must comply, while people using their own unhosted wallets are generally not money transmitters.

Question 42

What is wallet pregeneration?

Accepted Answer

Wallet pregeneration creates a wallet for a user before they first sign in, using their email or another identifier. You can send funds or rewards to that address in advance, and the user gets access when they sign in for the first time.

Question 43

How do you onboard users to crypto without seed phrases?

Accepted Answer

Use embedded or smart account wallets that tie access to methods people already use, such as email, social login or passkeys, and handle recovery through guardians or the provider's process instead of a written phrase. Users can then start with a familiar sign-in and keep control of their account.

Question 44

Server wallet vs embedded wallet: when to use which?

Accepted Answer

Use a server wallet when your backend acts on its own, as an AI agent does, signing automatically within policies. Use an embedded wallet when a person owns the account and approves transactions in your app. Many products need both: embedded wallets for users and server wallets for the agents acting for them.