> ## Documentation Index
> Fetch the complete documentation index at: https://crossmint-devin-1787949784-wallet-docs-two-concept-model.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Architecture
> Crossmint Wallets Architecture
Crossmint wallets are designed to provide:
1. **Flexibility**: A single wallet primitive that supports many use cases — end-user wallets, treasury management, disbursements, and more.
2. **High throughput and availability**: Wallets scale to the maximum throughput available per chain, at the fastest speeds possible.
3. **True ownership**: You and your users fully own every wallet. Even if Crossmint were to disappear, wallets continue to function — no vendor lock-in, no dependency on Crossmint infrastructure.
All while abstracting out all blockchain complexity — operate with them via simple REST APIs and SDKs.
## Dual Layer Architecture
Crossmint achieves this by separating two concerns: **the wallet itself** and **the authorization methods that control it**.
### The Core: Smart Contract Wallets
On EVM chains, Crossmint wallets are **smart contract wallets** implementing ERC-4337 with ERC-7579 modular extensions. Because the wallet is a smart contract, it lives natively on the blockchain — not in a private third-party server that you cannot audit or control.
On Solana, wallets use program-derived addresses (PDAs) with equivalent programmatic control.
On Stellar, wallets use Soroban smart contracts, with equivalent functionality and additional cost and developer experience improvements around the use of trustlines.
This smart contract foundation enables:
* **Seamless provider migration**: If you wish to migrate, you can update the wallet's recovery methods without changing the wallet address. Your users keep their address, balances, and transaction history regardless of infrastructure changes.
* **Programmable authorization logic**: Add multiple operational signers, with optional scoped permissions, plus multiple recovery methods, with logic fully auditable onchain.
* **Flexible gas sponsorship**: Wallets can pay gas in USDC, native token, or billed to your Crossmint account. See [Gas Sponsorship](/wallets/guides/gas-sponsorship).
* **Easier post-quantum migration**: Unlike wallets that couple wallet address with the underlying signer, Crossmint wallets will continue to operate with the same address once keys are upgraded to post-quantum cryptography.
All permissions are enforced **onchain and fully auditable**, removing the need to trust opaque infrastructure or Crossmint's backend. The wallet logic stays visible, enforceable, and portable.
Because the wallet is a smart contract on a public blockchain, it does not depend on Crossmint's servers to function. If Crossmint were to stop operating, you can interact with the wallet's smart contract directly — adding new signers, transferring assets, or migrating to another provider — using standard blockchain tools.
### The Control Layer
A **signer** is a cryptographic identity — such as a device key, passkey, server key, or external wallet — authorized to approve actions on the wallet's behalf.
Crossmint wallets use two kinds. **Operational signers** approve day-to-day transactions and messages. **Recovery methods** prove ownership of the wallet in order to change its operational signers or recovery methods.
| | Operational signer | Recovery method |
| ----------------------- | --------------------------------------------------------------- | ----------------------------------------------------------------------- |
| What it is for | Day-to-day transactions and message signing | Proving wallet ownership in order to change signers or recovery methods |
| Expected use | Frequent | Occasional |
| Examples | Device key, passkey, server key, Cloud KMS key, external wallet | Email, phone |
| Can be added or removed | Yes | Yes |
| Restrictions | Can have scopes and an expiration time | Control access to the wallet |
Operational signers and recovery methods are both entries in the wallet's onchain signer set. The smart contract enforces their permissions, not Crossmint's backend.
**For end-user wallets**, Crossmint uses the native key enclaves already present on your users' devices: the Secure Enclave on iOS and the Keystore on Android. Signatures happen directly on user hardware with no network round-trip to Crossmint or any third-party server. This means signing adds zero latency compared to a direct blockchain transaction — unlike MPC-based architectures that require key reconstruction across distributed infrastructure before every signature, or cloud TEEs which require a network round trip.
**For server-side and AI agent wallets**, Crossmint supports server key signers — a secret held in your own infrastructure that derives keypairs deterministically by chain type (EVM, Solana, or Stellar). Signing happens entirely in-process with no external calls.
**For company and treasury wallets**, Crossmint integrates with your existing cloud infrastructure — AWS KMS, Azure Key Vault, or GCP Cloud HSM. These Cloud KMS signers keep private keys non-extractable inside the provider's hardware security module, supporting up to 1,000 cryptographic signing operations per second per key.
**For recovery**, Crossmint provides recovery methods based on email or phone number OTP. These recovery methods are added to the wallet's onchain signer set, meaning recovery is enforced by the smart contract itself — not by Crossmint's backend. See [Signers](/wallets/concepts/signers) for operational signer guidance, [Recovery Methods](/wallets/concepts/recovery) for the recovery concept, and [Wallet Recovery](/wallets/guides/signers/wallet-recovery) for the recovery flow.
## What This Means in Practice
**For end-user wallets**, this architecture enables completely invisible, self-custodial wallets. Users sign transactions on their own device hardware without knowing a blockchain is involved. Gas can be fully sponsored when [gas sponsorship](/wallets/guides/gas-sponsorship) is enabled. There is no dependency on a third-party server to sign in or transact. And because the wallet is a smart contract, you have a clear migration path away from any provider — update the recovery method and move on, keeping the same wallet address and all its assets.
**For server-side and AI agent wallets**, you get low-latency, deterministic signing from your own infrastructure. A server key signer costs nothing per signing operation and supports throughput limited only by your backend. Separate recovery and signing secrets give you key rotation without wallet migration.
## Why Smart Contract Wallets
Wallets are becoming a foundational primitive for the entire economy and not just for crypto users, but for every person, company, AI agent, and connected device that needs to hold value or authorize payments. At that scale, wallet infrastructure must be extremely cheap to operate, flexible enough to support any custody model, and publicly auditable so that security is a matter of proof, not trust.
### The Problem with Off-Chain Key Storage
Most wallet infrastructure today stores keys off-chain, inside proprietary enclaves or distributed across MPC networks. This means:
* **Provider dependency**: Wallets depend on a specific provider's infrastructure to function.
* **Latency overhead**: Key reconstruction adds latency to every signature.
* **Painful migration**: Moving to a new provider means exporting keys and creating new wallet addresses.
These are reasonable trade-offs for certain use cases — but they are not the right foundation for millions of wallets transacting continuously.
### A Different Approach
Smart contract wallets take a different approach. The wallet is a program deployed on a public blockchain — it does not live in anyone's private infrastructure. The signer is completely separate and can be anything: a passkey on a user's phone, an AWS KMS key in your cloud, or a recovery credential.
The key stays whole. No splitting, no reconstruction, no added latency.
* **Security** comes from authorization logic that is readable onchain.
* **Recovery** rotates the wallet's onchain signers.
* **Migration** swaps signers instead of exporting keys.
### Why We Chose This Architecture
We chose this architecture because it is the only one that scales to the future we are building toward: **wallets as ubiquitous and permanent as email addresses, but programmable, auditable, and owned by no one except the people and systems that use them.**
Choose who can transact day to day
Choose how wallet ownership is verified
Learn how wallet recovery works