> ## Documentation Index
> Fetch the complete documentation index at: https://docs.walletsuite.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Management

> Non-custodial MPC threshold signing and share custody.

WalletSuite signing runs through **non-custodial MPC threshold signing**. WalletSuite operates a fully-managed cosigner and holds one key share; the customer holds the other. Both shares are required for every signature, and no full private key is ever assembled anywhere. For the cross-surface trust model see [Security Overview](/security/overview#trust-model).

## MPC threshold signing

| Property              | Detail                                                                              |
| --------------------- | ----------------------------------------------------------------------------------- |
| **Signature scheme**  | MPC threshold signing - multi-party, no full key                                    |
| **Quorum**            | both shares required to produce a signature                                         |
| **Share custody**     | WalletSuite operates the cosigner and holds one share; the customer holds the other |
| **Full-key assembly** | Never - no party ever holds a complete private key                                  |

Neither WalletSuite nor the customer can sign alone.

## Share custody

| Layer                      | Detail                                                                                         |
| -------------------------- | ---------------------------------------------------------------------------------------------- |
| **WalletSuite-side share** | Held by the fully-managed cosigner; envelope-encrypted at rest behind the scenes               |
| **Internal access**        | M-of-N quorum gated; audit-logged on every co-signing event                                    |
| **Share rotation**         | Periodic; transparent to the customer (no key-material reissue)                                |
| **Customer-side share**    | Held by the customer in their own storage - database, HSM, device, or passkey-wrapped envelope |

The customer-side share never reaches WalletSuite, and the WalletSuite-side share never reaches the customer.

## Signing flow

When a surface (MCP, SDK, or REST API) requests a signature:

1. The surface prepares the unsigned transaction with no key access.
2. The signing layer evaluates [policy](/core-concepts/policy-gates) before any signature is produced.
3. The customer share and the WalletSuite cosigner each produce a partial signature; the cosigner participates only after policy approval and never sees the customer share.
4. The combined threshold signature is returned to the surface.

The surface receives only the signature, never key material.

## External BYO signing

Customers who already run their own key-management stack can bring their own signer instead of the managed cosigner - KMS, HSM, or multisig, customer-managed and outside WalletSuite (SDK or REST). See [Security Overview](/security/overview#trust-model).

## What WalletSuite never sees

Applies to all surfaces (MCP, SDK, REST API):

| Secret                  | Where it lives                          | WalletSuite access        |
| ----------------------- | --------------------------------------- | ------------------------- |
| Full private keys       | Never assembled                         | Never                     |
| Customer-side MPC share | Customer's own storage                  | Never reaches WalletSuite |
| External BYO keys       | Customer-managed (KMS / HSM / multisig) | Never                     |

## Related

* [Security Overview](/security/overview#trust-model) - the full trust model
* [Policy Gates](/core-concepts/policy-gates) - constraining what agent keys can do
* [Audit Trail](/security/audit-trail) - logging every signing operation