Signers

Understand operational signers for day-to-day wallet control and compare signer types.

A signer is a cryptographic identity authorized to approve actions on a Crossmint wallet. Because wallets are independent of their signing keys, you can add, remove, or rotate signers without changing wallet addresses or moving assets.

​

How Signers Work

Crossmint wallets separate operational signers, which transact day to day, from recovery methods, which change wallet control.

	Operational Signers	Recovery Methods
Purpose	Approve transactions and sign messages	Approve changes to signers and restore access
Usage	Day-to-day operations	Occasional changes to wallet control
Permissions	Can be restricted by scope and expiration	Can change signers and send transactions

Both are registered onchain, and the wallet’s smart contract enforces which actions each one can approve. A recovery method can also send transactions.

Learn about Recovery Methods

​

Choosing Your Signers

Choose a signing configuration based on who controls the wallet and your security, performance, and recovery requirements.

Use Case	Recommended Operational Signer	Recovery Method	Custody Model
End-user wallets (non-custodial)	Device signer or passkey	Email or phone	Non-custodial
End-user wallets (custodial)	Server signer	Server signer (different secret)	Custodial
Treasury & enterprise wallets	Server signer or Cloud KMS	Server signer or Cloud KMS (different key)	Custodial
AI agents (user-hosted)	Device signer or passkey	Email or phone	Non-custodial
AI agents (platform-hosted)	Server signer	Server signer (different secret)	Custodial

These are recommended configurations, not required pairings. For additional security, use signer scopes to restrict tokens, spending limits, recipients, and expiration dates.

To require several people to approve each transaction, use a quorum signer as the operational signer (for example, any 3 of 5 company officers). Quorum signers are an enterprise feature.

​

Signer Types

Crossmint supports multiple signer types with different security characteristics, user experiences, and chain compatibility.

​

Capability Matrix

Type	Operational signer?	Recovery method?	Chains	Notes
Device	✅	❌	EVM, Solana, Stellar	Default for client-side wallets; per-device, not portable
Passkey	✅	✅ (EVM, Stellar)	EVM, Solana, Stellar	Biometric or PIN on every signature
Server	✅	✅	EVM, Solana, Stellar	Deterministic derivation from a secret you hold
Email	✅	✅	All	One-time code
Phone	✅	✅	All	One-time code over SMS or WhatsApp
External wallet	✅	✅	EVM, Solana, Stellar	User signs with a wallet they already control
Cloud KMS	✅	✅	EVM, Solana, Stellar	Non-extractable key in AWS KMS, Azure Key Vault, GCP Cloud HSM

​

Device Signers

Approve transactions seamlessly using keys secured on user devices. Generate P256 keys in secure hardware, including Apple Secure Enclave, Android Keystore, or supported browser credential stores.

Transactions can be approved silently or with optional biometric authentication. Device signers are the default for supported client-side wallets. Each device has its own signer, so recovery is needed when switching devices.

In web apps, some browsers, such as Safari, delete the device signer key when they restart. See Browser Support.

​

Passkey Signers

Let users approve transactions using biometrics or a PIN. Passkeys use WebAuthn and can sync across devices through providers like iCloud Keychain or Google Password Manager.

Each approval requires user authentication. Passkeys can also serve as recovery methods on EVM and Stellar.

When multiple passkeys are registered, specify the passkey id. A single passkey is selected automatically.

​

Server Signers

Approve transactions directly from your backend, without external signing requests. Keys are derived deterministically from secrets stored in your infrastructure.

The same secret generates a consistent signer address across EVM chains within a project and environment, with separate addresses for Solana and Stellar.

Ideal for automated payments, treasury operations, and platform-hosted agents.

​

Cloud KMS Signers

Protect signing keys using AWS KMS, Azure Key Vault, or GCP Cloud HSM. Private keys remain non-extractable within the cloud provider’s infrastructure.

Cloud KMS supports IAM controls, audit logging, and optional multi-party approvals, making it suitable for enterprise and treasury wallets.

​

Email & Phone OTP Signers

Approve wallet actions using one-time verification codes delivered through email, SMS, or WhatsApp.

These methods can be used for operational signing and recovery, depending on the wallet configuration.

​

External Wallet Signers

Approve transactions using an existing wallet, such as MetaMask or Phantom.

Integrate by providing the wallet address and a signing callback that handles chain-specific payloads.

​

Managing Signers

​

Add and Remove Signers

Add operational signers to grant transaction authority, or remove them to revoke access.

• A wallet can have up to 16 signers in total, counting recovery methods and operational signers together. A request that would take the wallet over the limit fails with HTTP 400 and the error code SIGNER_LIMIT_EXCEEDED. Adding a signer that is already on the wallet does not count against the limit again.
• Signers can be installed immediately or on their first transaction.
• One of the wallet’s recovery methods must approve adding or removing an operational signer. The SDK does this with the selected recovery method. With the REST API, you must approve the resulting transaction yourself.
• Removing a signer revokes its onchain authority and hides it from the active signer list.

Learn how to manage signers

​

Restrict Signer Permissions

A signer added after wallet creation (through addSigner() or the register delegated key endpoint) has the same transaction authority as the wallet’s recovery methods by default. To grant narrower authority, use signer scopes to define:

• Allowed tokens: Restrict which assets a signer can transfer.
• Spending limits: Cap authorized transfer amounts.
• Recipient allowlists: Limit transfers to approved addresses.
• Expiration: Set expiresAt to an ISO 8601 timestamp. After that time, the signer is denied.

Scopes are immutable for the lifetime of the signer. To change a signer’s permissions, replace it with a new signer that has the new scopes.

Learn about Signer Scopes

​

See Also

Add Signers

Add operational signers to a wallet

Signer Scopes

Set onchain signing permissions

Remove a Signer

Revoke signing access

Recovery Methods

Configure wallet recovery

Custody Models

Explore custody options