Live on testnet · founding operator set forming
Embedded wallets with no single operator
Social login, smart accounts, and threshold signing — with one difference that changes the risk profile entirely. You pick the operators. You set the threshold. You can change either one, live, without migrating a single key.
Open source · FROST (RFC 9591) · ZK proof of OAuth · ERC-1271 / ERC-4337
The actual problem
It isn’t custody. It’s authority.
Where the key lives matters less than who gets to decide it should sign. Concentrate that decision in one organization and you have rebuilt the exact attack surface the rest of the stack was designed to remove — breaking the math is hard, reaching the company that holds the authority is the path nearly every real incident takes.
Centralized custody
One entity decides what gets signed for every customer. A breach, a subpoena, or an acquisition reaches all of it at once.
Do it yourself
Whoever holds the key has the authority. No threshold, no policy layer, no audit trail. Fine for a demo, dangerous for real money.
TEE providers
The enclave protects the key material beautifully. It cannot distribute the operator's authority — compromise the operator and a valid signature follows.
How it works
Two layers. Fail-closed.
Layer 1 — the verifier network
Every operator in your group independently checks two things before contributing its share: that the principal has rights on this key, and that the signature is bound to the account that will enforce your policy on-chain. They handle proofs, not secrets — a zero-knowledge proof of a valid credential, never the credential itself.
Layer 2 — the smart account
Balances, spending caps, destination allowlists — the invariants that depend on settled state are enforced by the chain itself, atomically, at execution time. ERC-1271 admits multi-party signers natively, so Layer 1 drops in as the account’s signer with no custom integration.
Both must approve. Either can veto. Neither can override the other.
A 3-of-5 group
threshold 3 · parties 5
Any three of the five produce the signature. Two can be offline, or actively hostile, and nothing changes — and no operator, at any point, holds a whole key.
Feature parity, different foundation
Everything you expect. Nothing you have to trust.
Social login, embedded wallets, smart accounts, session signers, policies, webhooks, per-active-wallet pricing. The developer experience is the one the market already settled on — what changes is who can authorize on your behalf.
| Property | Centralized providers | Signet |
|---|---|---|
| Social login and embedded wallets | ✓ | ✓ |
| Smart accounts (ERC-4337) | ✓ | ✓ |
| Session signers for agents | ✓ | ✓ |
| You choose the operator set | — | ✓ |
| You set the signing threshold | — | ✓ |
| Swap operators with no downtime or migration | — | ✓ |
| Run some operators yourself | — | ✓ |
| Non-custody you can verify, not just read | — | ✓ |
| Open source, auditable end to end | — | ✓ |
Your wallet infrastructure should be as decentralized as the chain it sits on.
Create a group in a few minutes: choose your operators, set your threshold, and walk away with a working application key.