For AI agents: the documentation index is at /llms.txt, and this page is available as Markdown at /gateway/wallet-control.md.
Wallet control
True Markets is non-custodial. Every user wallet needs two approvals to move funds: a signer key and True Markets. We can never move funds on our own. Whoever holds the signer key, your servers or your user, controls the wallet, and you choose which for each user.
How wallets work
Wallets run on Turnkey, and each private key is created inside a secure enclave it never leaves. Each user's wallet is separate, and every transaction from it needs both approvals.
Funds in a user's wallet can be sent to any address, at any time. We approve only the transactions we built for an order or transfer you placed.
Who signs
Where the signer key lives decides who controls the wallet. There are three setups.
| Your servers sign, one key | Your servers sign, a key per user | Your user signs | |
|---|---|---|---|
| Who approves each trade | your servers | your servers | your user |
| Runs without the user | yes | yes | no |
| You can move the user's funds | yes | yes | no |
| One signer key signs for | every user | one user | one user |
| Built for | one-tap buying and automated strategies | automated products that keep each customer separate | apps where users trade for themselves |
You choose the setup when you create each user, so one organization can mix them: automated accounts your servers sign for, next to users who sign their own trades.
How each setup signs a trade
Orders and transfers are placed and executed the same way in every setup. Only the signing step moves.
- Your serverPlaces the order
- True MarketsReturns the payloads
- Your serverSigns each payload
- Your serverExecutes
- Your serverPlaces the order
- True MarketsReturns the payloads
- Your appUser approves and signs
- Your serverExecutes
When your user signs, your server passes each payload to your app, the user's device signs it, and the signature comes back to your server for execute. Your users never call True Markets themselves.
If a key leaks
Moving funds takes two keys: your organization API key, which mints the token that executes, and a signer key, which signs. One without the other moves nothing.
| What leaked | Can it move funds? |
|---|---|
| A signer key | No. We approve only what you execute with your organization token. |
| Your organization API key | No. It can place orders, but it can't sign them. |
| Both | Yes, for every user registered with that signer key. |
How far a leak of both reaches depends on the setup:
You can revoke an organization API key on the developer console's API keys page. No new tokens can be minted from it, and the tokens it already minted expire within the hour.
Register the signer key
Send signer_public_key when you create a user: a 33-byte compressed P-256 public key, as 66 hex characters. Every setup uses the same field; only who holds the private half differs. User accounts shows the call, and How requests and signing work shows how a payload is signed.
Next: User accounts
- Need help? [email protected]
- Chat with us on Discord
- See what changed in the changelog