---
title: "Wallet control"
url: https://docs.truemarkets.co/gateway/wallet-control
description: "True Markets is non-custodial. Every user wallet needs a signer key and our approval to move funds, and whoever holds the signer key controls the wallet."
---

Docs index: https://docs.truemarkets.co/llms.txt

# Wallet control

True Markets is non-custodial. Every user wallet needs two approvals to move funds: a signer key and True Markets. We can never move funds on our own. Whoever holds the signer key, your servers or your user, controls the wallet, and you choose which for each user.

## How wallets work

- **Approval 1: Signer key**. Held by your servers or your user. Signs each transaction you execute.
- **User's wallet: Two approvals to move funds**. Runs on Turnkey. Private key sealed in a secure enclave. One wallet per user, on Solana and EVM.
- **Approval 2: True Markets**. Co-signs what you execute with your organization token. Can't move funds on its own.

Nobody holds a wallet's private key: not Turnkey, not True Markets, not you. The signer key holds the authority to approve.

Wallets run on [Turnkey](https://www.turnkey.com), and each private key is created inside a secure enclave it never leaves. Each user's wallet is separate, and every transaction from it needs both approvals.

Funds in a user's wallet can be sent to any address, at any time. We approve only the transactions we built for an order or transfer you placed.

## Who signs

Where the signer key lives decides who controls the wallet. There are three setups.

- **Your servers sign, one key** (Your servers: one key): Trades run without the user. One key signs for every user.
- **Your servers sign, a key per user** (Your servers: key A, key B, key C): Trades run without the user. You keep a key for every user.
- **Your user signs** (User's device: key A, key B, key C): You never move their funds. The user approves every trade.

|                               | Your servers sign, one key              | Your servers sign, a key per user                   | Your user signs                       |
| ----------------------------- | --------------------------------------- | --------------------------------------------------- | ------------------------------------- |
| Who approves each trade       | your servers                            | your servers                                        | your user                             |
| Runs without the user         | yes                                     | yes                                                 | no                                    |
| You can move the user's funds | yes                                     | yes                                                 | no                                    |
| One signer key signs for      | every user                              | one user                                            | one user                              |
| Built for                     | one-tap buying and automated strategies | automated products that keep each customer separate | apps where users trade for themselves |

You choose the setup when you create each user, so one organization can mix them: automated accounts your servers sign for, next to users who sign their own trades.

### How each setup signs a trade

Orders and transfers are placed and executed the same way in every setup. Only the signing step moves.

**Your servers sign**: Your server: places the order → True Markets: returns the payloads → Your server: signs each payload → Your server: executes

**Your user signs**: Your server: places the order → True Markets: returns the payloads → Your app: user approves and signs → Your server: executes

When your user signs, your server passes each payload to your app, the user's device signs it, and the signature comes back to your server for execute. Your users never call True Markets themselves.

## If a key leaks

Moving funds takes two keys: your organization API key, which mints the token that executes, and a signer key, which signs. One without the other moves nothing.

| What leaked               | Can it move funds?                                                 |
| ------------------------- | ------------------------------------------------------------------ |
| A signer key              | No. We approve only what you execute with your organization token. |
| Your organization API key | No. It can place orders, but it can't sign them.                   |
| Both                      | Yes, for every user registered with that signer key.               |

How far a leak of both reaches depends on the setup:

- **One key for every user**, with your API key also leaked: Every user's wallet is exposed.
- **A key per user**, with your API key also leaked: Only cust_7781's wallet is exposed.

You can revoke an organization API key on the [developer console](https://console.truemarkets.co)'s API keys page. No new tokens can be minted from it, and the tokens it already minted expire within the hour.

## Register the signer key

Send `signer_public_key` when you create a user: a 33-byte compressed P-256 public key, as 66 hex characters. Every setup uses the same field; only who holds the private half differs. [User accounts](https://docs.truemarkets.co/gateway/create-a-user) shows the call, and [How requests and signing work](https://docs.truemarkets.co/gateway/requests-and-signing) shows how a payload is signed.

Next: [User accounts](https://docs.truemarkets.co/gateway/create-a-user)