Embedded Wallets Overview
1Claw embedded wallets give your end-users native, multi-chain crypto wallets inside your app — without browser extensions, seed phrases, or a separate wallet provider. Keys are generated in HSM-backed infrastructure, stored in a per-org __treasury-keys vault, and surfaced through passwordless auth plus an optional React widget.
This guide series covers the full embedded-wallet flow: platform setup, authentication, transactions, spend policies, React integration, fiat ramps, and advanced treasury features.
Embedded wallets require a Pro or higher plan for the Platform API. Treasury wallets themselves are available on all tiers and count toward your org wallet quota.
What you get
| Capability | Description |
|---|---|
| Passwordless auth | Email OTP, Google/Apple/Discord social login, passkeys, and Sign in with 1Claw OAuth |
| Multi-chain wallets | Ethereum, Bitcoin, Solana, XRP, Cardano, Tron — one user, six addresses |
| Send / swap / receive | Native and token transfers, 0x DEX swaps, optional ERC-4337 gasless sends |
| Spend policies | App-level defaults and per-user overrides enforced before signing |
| React widget | @1claw/wallet-react — full UI or headless useOneclawWallet() |
| Platform bootstrap | Declarative templates provision vaults, agents, wallets, and policies per user |
| Fiat ramps | Coinbase Onramp and MoonPay widget URLs |
| Audit & custody | Hash-chained audit log, optional MPC and CMEK on paid tiers |
Architecture
Embedded wallets sit on three layers:
- Your app — Embeds
@1claw/wallet-reactor calls auth + treasury APIs from your frontend/backend. - Platform API — Your
plt_key provisions users, bootstraps resources from templates, and sets spend policies. End-users authenticate with JWTs issued after OTP/social/OAuth login. - Treasury wallets — HSM-generated keys in
__treasury-keysatusers/{user_id}/chains/{chain}/private_key. Sends and swaps require human step-up (X-Auth-Confirmpassword or passkey tx token).
When you bootstrap with platform_locked: true, your platform operator account cannot read end-user secret values — only lifecycle operations (create, delete, rotate). See Platform API — custody.
Embedded wallets vs agent signing keys
Both use strong cryptography, but they serve different principals:
| Embedded wallet (treasury) | Agent signing key | |
|---|---|---|
| Principal | Human end-user | AI agent |
| API access | Human JWT only (require_human) | Agent JWT + Intents API |
| Key storage | __treasury-keys → users/{id}/chains/... | __agent-keys → agents/{id}/chains/... |
| Typical use | In-app Send/Swap/Receive for your users | Autonomous on-chain actions, Intents API |
| Guardrails | Spend policies | Transaction guardrails + policies |
| Provisioning | Auto on first login (auto_provision_chains) or POST /v1/treasury/wallets/generate | Human provisions via dashboard or POST /v1/agents/{id}/signing-keys |
Agents receive 403 on all treasury wallet endpoints. If your product needs programmatic signing for bots, provision agent signing keys separately — often via Platform bootstrap templates.
End-to-end user journey
- Developer registers a platform app → receives
plt_key. - Developer creates a bootstrap template (optional agents + policies) and embeds the wallet widget.
- End-user signs in via email OTP or social login → treasury wallets auto-provision for requested chains.
- End-user sends, swaps, or buys crypto — subject to your spend policies and step-up auth.
- Platform receives webhooks (
platform.user.connected,wallet.transfer.sent, etc.) if configured.
Security & trust
Embedded wallet keys inherit 1Claw's envelope encryption, audit hash chain, and tier-aware HSM protection. For a deeper security picture:
- Security overview — threat model, attestation, audit verification
- Trust model comparison — whole-agent governance vs signing-only infrastructure
- Migrate from Turnkey — mapping wallets and policies to 1Claw
- Trust model comparison — platform positioning vs signing-only providers
Guide map
| # | Guide | Topics |
|---|---|---|
| 1 | Overview | Architecture, vs agent keys, journey |
| 2 | Getting started | Platform app, plt_ key, bootstrap, claim flow |
| 3 | Authentication | Email OTP, social login, passkeys, Sign in with 1Claw |
| 4 | Multi-chain wallets | Six chains, generation, balances, import/export |
| 5 | Send, swap, receive | Transfers, 0x swaps, gasless, passkey tx auth |
| 6 | Spend policies | App defaults, per-user overrides |
| 7 | Wallet access policies | Role/principal grants (v0.53.1) |
| 8 | React integration | @1claw/wallet-react props and theming |
| 9 | Platform API | Upsert, bootstrap, templates, grants |
| 10 | Fiat on/off ramps | Coinbase Onramp, MoonPay |
| 11 | Advanced | Deposits, internal ledger, sub-orgs, CMEK/MPC |
| 12 | Security and custody | HSM, platform_locked, enforcement layers |
| 13 | Testing and production | Staging checklist, go-live |
Quick links
- 2-minute quickstart — minimal code sample
@1claw/wallet-reactreference — component API- Platform API overview — full platform developer docs
- Treasury wallets — underlying wallet system