Crossmint Wallets Signers and custody

A signer is a digital identity authorized to approve actions on the wallet’s behalf. When a transaction is initiated, the signer digitally signs it, thereby authorizing and enabling its execution. Crossmint supports the following signer types:

Email, phone number, or social login
Passkey
External wallet
API key

Choosing a signer type

Signer types will define the custody and user experience of a wallet.

Signer type	Custody	User experience
Email, phone number, social login	Non-custodial	Users authenticate once per device the first time they are going to transact. Future transactions can happen without needing user interaction.
Passkey	Non-custodial	Transactions need to be signed every time with the device biometrics or password manager.
External Wallet	Non-custodial or custodial depending on who has access to the wallet.	Transactions need to be signed every time with the external wallet.
API Key	Custodial	All transactions can happen without needing user interaction.

If you use a non-custodial signer and a custodial signer at the same time, the wallet will be considered custodial.

Choose custodial signers if:

You are licensed for custody
You are building use cases that don’t require custody, such as collectibles or utility token management
You want to handle asset management and transactions on behalf of users
You need a simple, server-side solution without user interaction for blockchain operations

Choose non-custodial signers if:

You are building use cases that require license (e.g. holding stablecoins) and you don’t have it
Self custody is important to your users

Signer types

Email signers are undergoing a security audit and will be production ready early July.

Phone number and social login signers are available under private access. Contact us if you need access.

Email, phone number, and social login signers enable users to access their wallets and perform transactions seamlessly using their email address, phone number, or social account. Users just need to verify their email address, phone number, or social account once per device to access their wallet.

How does it work?

This signer type uses a master secret generated inside a Trusted Execution Environment (TEE) that runs open-source, verifiable code. This master secret is never stored or exposed outside the TEE and is protected by user-controlled credentials, such as email authentication. Once created, the master secret is split into two parts using Shamir Secret Sharing: a device share (stored securely on the users device) and an auth share (stored on Crossmint’s backend). Both shares are required to reconstruct the master secret, and this only happens locally within a secure enclave on the user’s device.When a user wants to sign a transaction, the host application sends a request to a secure iframe. The device share and the auth share are combined within this local secure environment to reconstruct the master secret, derive the necessary keypair, and produce the signature. At no point do the host application or Crossmint have access to the full master secret or the private key; the signing process and key management are isolated from both parties, ensuring that sensitive cryptographic material is never exposed.

Is this signer type non-custodial?

Yes, this system is considered non-custodial because neither the host application nor Crossmint can unilaterally access or control the user’s keys. The host application never sees the key shares or the master secret, and Crossmint only holds one share, which is useless on its own. The code running in the TEE is publicly verifiable and tamper-proof, and all sensitive operations occur within secure, user-controlled environments. This guarantees that only the user, through their device and authentication, can authorize transactions, maintaining true user custody over their cryptographic keys.

Configuration

React
Node.js
React Native

import { useWallet } from '@crossmint/client-sdk-react-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "<your-chain>",
    signer: {
        type: "email",
    },
});

const wallet = await crossmintWallets.createWallet({
    chain: "<your-chain>",
    signer: {
        type: "email",
    },
});

import { useWallet } from '@crossmint/client-sdk-react-native-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "<your-chain>",
    signer: {
        type: "email",
    },
});

Passkey

Passkeys enable users to access their wallets and perform transactions using their device biometrics or password manager. They are built on top of the WebAuthn standard and are supported by most modern browsers.

Configuration

React
Node.js
React Native

import { useWallet } from '@crossmint/client-sdk-react-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "solana",
    signer: {
        type: "passkey",
    },
});

const wallet = await crossmintWallets.createWallet({
    chain: "<your-chain>",
    signer: {
        type: "passkey",
    },
});

import { useWallet } from '@crossmint/client-sdk-react-native-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "<your-chain>",
    signer: {
        type: "passkey",
    },
});

External wallet

External wallets (or keypairs) can be used as signers to access and transact with a wallet. This includes also wallets

Configuration

React
Node.js
React Native

import { useWallet } from '@crossmint/client-sdk-react-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "<your-chain>",
    signer: {
        type: "external-wallet",
        address: "<your-wallet-address>",
    },
});

const wallet = await crossmintWallets.createWallet({
    chain: "<your-chain>",
    signer: {
        type: "external-wallet",
        address: "<your-wallet-address>",
    },
});

import { useWallet } from '@crossmint/client-sdk-react-native-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "<your-chain>",
    signer: {
        type: "external-wallet",
        address: "<your-wallet-address>",
    },
});

API key

A project’s API key can also be used as a signer for your wallet. This allows transacting with a wallet without needing the user to sign at any point.

Configuration

React
Node.js
React Native

import { useWallet } from '@crossmint/client-sdk-react-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "<your-chain>",
    signer: {
        type: "api-key",
    },
});

const wallet = await crossmintWallets.createWallet({
    chain: "<your-chain>",
    signer: {
        type: "api-key",
    },
});

import { useWallet } from '@crossmint/client-sdk-react-native-ui';

const { getOrCreateWallet } = useWallet();

const wallet = await getOrCreateWallet({
    chain: "<your-chain>",
    signer: {
        type: "api-key",
    },
});

Introduction

Wallets

Authentication

Tokenization (Minting)

Verifiable Credentials

Checkout

Signers and custody

Choosing a signer type

Signer types

Configuration

Passkey

Configuration

External wallet

Configuration

API key

Configuration

​Choosing a signer type

​Signer types

​Email, phone number, and social login

​Configuration

​Passkey

​Configuration

​External wallet

​Configuration

​API key

​Configuration

Choosing a signer type

Signer types

Email, phone number, and social login

Configuration

Passkey

Configuration

External wallet

Configuration

API key

Configuration