Key Management

WalletSuite signing runs through non-custodial MPC threshold signing. WalletSuite operates a fully-managed cosigner and holds one key share; the customer holds the other. Both shares are required for every signature, and no full private key is ever assembled anywhere. For the cross-surface trust model see Security Overview.

​

MPC threshold signing

Neither WalletSuite nor the customer can sign alone.

​

Share custody

The customer-side share never reaches WalletSuite, and the WalletSuite-side share never reaches the customer.

​

Signing flow

When a surface (MCP, SDK, or REST API) requests a signature:

1. The surface prepares the unsigned transaction with no key access.
2. The signing layer evaluates policy before any signature is produced.
3. The customer share and the WalletSuite cosigner each produce a partial signature; the cosigner participates only after policy approval and never sees the customer share.
4. The combined threshold signature is returned to the surface.

The surface receives only the signature, never key material.

​

External BYO signing

Customers who already run their own key-management stack can bring their own signer instead of the managed cosigner - KMS, HSM, or multisig, customer-managed and outside WalletSuite (SDK or REST). See Security Overview.

​

What WalletSuite never sees

Applies to all surfaces (MCP, SDK, REST API):

​

Related

• Security Overview - the full trust model
• Policy Gates - constraining what agent keys can do
• Audit Trail - logging every signing operation