Platform / Wallets

AA-native wallets, inside your app.

OVAAL's wallet infrastructure is a production ERC-4337 SDK that licensed EU and MENA fintechs integrate into their existing app to ship passkey-based, non-custodial smart-contract wallets under their own brand and license. Your users hold their own keys. Your brand fronts the wallet. OVAAL never holds funds.

Get the integration briefSee the SDK

What your users get.

Passkey onboarding

No seed phrase, no extension install. Webauthn + platform biometric. Familiar login UX that compliance + product teams already approve of.

Session keys

Time-boxed, scope-limited signing for automation. End-user approves a rule once; execution runs without exposing the root key.

Paymaster-backed transactions

Partner sponsors gas; user never sees ETH. Partner recovers cost via the transaction flow or pricing tier.

Social + MPC recovery

Optional second-factor or recovery-friend flows. Partner chooses the recovery model that fits their license.

Multi-chain from day one

Base, Arbitrum, Optimism, Ethereum, and Polygon supported in production. Solana lands H2 2026. Additional chains ship per partner demand.

Non-custodial by default

Partner never holds end-user keys. OVAAL never holds end-user keys. End-user's passkey or MPC share holds the signing authority.

How it integrates.

Your app, our wallet layer.

Partner app UI

Your brand. Your KYC. Your identity stack.

OVAAL SDK

Wallet creation, AA orchestration, paymaster policy, session keys.

End-user's key

Passkey or MPC share. Non-custodial. On-chain smart account.

import { OvaalClient } from '@ovaal/sdk';

const ovaal = new OvaalClient({
  apiKey: process.env.OVAAL_API_KEY,
  partnerId: 'prt_...',
  environment: 'staging',
});

const wallet = await ovaal.wallets.create({
  partnerUserId: 'user_abc123',
  chain: 'base',
  recovery: { type: 'passkey' },
  policy: {
    maxTxValueUsd: 10_000,
    dailyCapUsd: 50_000,
    jurisdiction: 'DE',
  },
});
// Returns: { walletId, address, recoveryHandle }

Security choices you can defend.

  • Non-custodial by default. Partner never holds end-user keys. OVAAL never holds end-user keys. End-user's passkey or MPC share holds signing authority.
  • Audited contracts. Smart-account implementations are audited by a tier-1 firm. Report available to signed partners under NDA. See /security/.
  • Session-key scopes. Cannot exceed partner-configured policy. Hard caps per-tx + per-day. Time-to-live maximum.
  • Oracle-aware automation. Price-triggered session keys check oracle deviation before execution; pause on suspicious market conditions.
  • Key rotation + revocation. Revoke any session key immediately via API. Full audit trail.

Under your control.

What partner keeps:

  • Identity (your KYC/KYB stack → our wallet layer receives the user ID)
  • Wallet UI (white-label or fully custom — OVAAL ships reference components, not a finished UI)
  • Recovery policy (passkey only, passkey + social, passkey + MPC — your choice per jurisdiction)
  • Compliance hooks (you subscribe to webhooks for every wallet operation; pause/reverse per your policy)

Evaluate the wallet layer.

Get the integration briefBook a technical call