Passkey onboarding
No seed phrase, no extension install. Webauthn + platform biometric. Familiar login UX that compliance + product teams already approve of.
Platform / Wallets
AA-native wallets, inside your app.
OVAAL's wallet infrastructure is a production ERC-4337 SDK that licensed EU and MENA fintechs integrate into their existing app to ship passkey-based, non-custodial smart-contract wallets under their own brand and license. Your users hold their own keys. Your brand fronts the wallet. OVAAL never holds funds.
What your users get.
Session keys
Time-boxed, scope-limited signing for automation. End-user approves a rule once; execution runs without exposing the root key.
Paymaster-backed transactions
Partner sponsors gas; user never sees ETH. Partner recovers cost via the transaction flow or pricing tier.
Social + MPC recovery
Optional second-factor or recovery-friend flows. Partner chooses the recovery model that fits their license.
Multi-chain from day one
Base, Arbitrum, Optimism, Ethereum, and Polygon supported in production. Solana lands H2 2026. Additional chains ship per partner demand.
Non-custodial by default
Partner never holds end-user keys. OVAAL never holds end-user keys. End-user's passkey or MPC share holds the signing authority.
How it integrates.
Your app, our wallet layer.
Partner app UI
Your brand. Your KYC. Your identity stack.
OVAAL SDK
Wallet creation, AA orchestration, paymaster policy, session keys.
End-user's key
Passkey or MPC share. Non-custodial. On-chain smart account.
import { OvaalClient } from '@ovaal/sdk';
const ovaal = new OvaalClient({
apiKey: process.env.OVAAL_API_KEY,
partnerId: 'prt_...',
environment: 'staging',
});
const wallet = await ovaal.wallets.create({
partnerUserId: 'user_abc123',
chain: 'base',
recovery: { type: 'passkey' },
policy: {
maxTxValueUsd: 10_000,
dailyCapUsd: 50_000,
jurisdiction: 'DE',
},
});
// Returns: { walletId, address, recoveryHandle }Security choices you can defend.
- Non-custodial by default. Partner never holds end-user keys. OVAAL never holds end-user keys. End-user's passkey or MPC share holds signing authority.
- Audited contracts. Smart-account implementations are audited by a tier-1 firm. Report available to signed partners under NDA. See /security/.
- Session-key scopes. Cannot exceed partner-configured policy. Hard caps per-tx + per-day. Time-to-live maximum.
- Oracle-aware automation. Price-triggered session keys check oracle deviation before execution; pause on suspicious market conditions.
- Key rotation + revocation. Revoke any session key immediately via API. Full audit trail.
Under your control.
What partner keeps:
- Identity (your KYC/KYB stack → our wallet layer receives the user ID)
- Wallet UI (white-label or fully custom — OVAAL ships reference components, not a finished UI)
- Recovery policy (passkey only, passkey + social, passkey + MPC — your choice per jurisdiction)
- Compliance hooks (you subscribe to webhooks for every wallet operation; pause/reverse per your policy)