Signing Providers

The Wallet Gateway does not have to hold private keys. Signing is delegated to a signing provider chosen per wallet, so you decide where each wallet’s keys live and who performs the cryptographic signing. Different wallets in the same Wallet Gateway can use different providers, and you select the provider per party when you create a wallet. When a wallet submits a transaction, the Wallet Gateway hands the prepared transaction to that wallet’s signing provider, which signs it with the party’s key and returns it for the Wallet Gateway to submit.

Configuration

List each provider you want to use under signingProviders. Presence of the key opts the provider in. Non-secret settings come from the config object. Secret values stay in the environment, *Env fields name those variables (each defaults to the name in the environment-variable tables below).

{
    "signingProviders": {
        "participant": {},
        "fireblocks": {
            "apiPath": "https://api.fireblocks.io/v1",
            "apiKeyEnv": "FIREBLOCKS_API_KEY",
            "secretEnv": "FIREBLOCKS_SECRET"
        }
    }
}

Omit a provider to leave it unregistered. An empty "signingProviders": {} registers none.

If signingProviders is omitted entirely, the Wallet Gateway uses a legacy discovery mode (every provider is available when its required environment variables are set). That mode is deprecated and will be removed.

Available providers

Provider	Key custody	Recommended for production
Internal	Wallet Gateway signing store database	No - local development and testing only
Participant	Canton participant node	Yes - for deployments with a dedicated participant
Fireblocks	Fireblocks (HSM-backed)	Yes
Blockdaemon	Blockdaemon infrastructure	Yes
DFNS	DFNS (MPC)	Yes
Securosys	Securosys TSB (HSM-backed)	Yes
BitGo	BitGo (MPC)	Yes

The internal provider stores private keys in the Wallet Gateway’s signing store database. Do not use it for wallets holding valuable assets. Prefer a participant node or an external custody provider in production.

Internal

Stores private keys directly in the Wallet Gateway’s signing store database and signs transactions itself. Suitable for development and testing only. See Configure the Wallet Gateway.

Config field	Required	Description
`signingProviders.walletKernel`	yes	Include `{}` to opt in.
`signingStore`	yes	Signing-store database. The provider is unavailable if this is omitted.

Private keys are stored in the signing store database. If it is compromised, all keys are at risk; if it is lost, they are unrecoverable. Protect the database file with strict filesystem permissions and never commit it to version control.

Participant

Uses a Canton participant node to sign. The participant holds the key material and performs all cryptographic operations, so keys never live in the Wallet Gateway. When a transaction is submitted, the Wallet Gateway forwards the command to the participant node, which signs it using the party’s key from the participant’s keystore.

Config field	Required	Description
`signingProviders.participant`	yes	Include `{}` to opt in.

Fireblocks

Enterprise-grade, HSM-backed key management and signing from Fireblocks. Keys stay in Fireblocks’ secure infrastructure. Complete steps 1-3 from the Fireblocks signing documentation. The API key is the value in the API User (ID) column in the Fireblocks API users table, then set the following config fields and environment variables:

Config field	Required	Description
`signingProviders.fireblocks`	yes	Include this object to opt in.
`signingProviders.fireblocks.apiPath`	no	Fireblocks API URL. Defaults to `https://api.fireblocks.io/v1`.
`signingProviders.fireblocks.apiKeyEnv`	no	Name of the env var that holds the API key. Defaults to `FIREBLOCKS_API_KEY`.
`signingProviders.fireblocks.secretEnv`	no	Name of the env var that holds the API secret. Defaults to `FIREBLOCKS_SECRET`.

Environment variable	Required	Description
`FIREBLOCKS_API_KEY`	yes	Fireblocks API key. Override name with `apiKeyEnv`.
`FIREBLOCKS_SECRET`	yes	Fireblocks API secret. Override name with `secretEnv`.

Blockdaemon

Managed signing from Blockdaemon’s infrastructure. Complete the setup from the Blockdaemon signing documentation, then set the following config fields and environment variables:

Config field	Required	Description
`signingProviders.blockdaemon`	yes	Include this object to opt in.
`signingProviders.blockdaemon.baseUrl`	no	Blockdaemon API URL. Defaults to `http://localhost:5080/api/cwp/canton`.
`signingProviders.blockdaemon.caip2`	no	CAIP-2 network identifier. Defaults to `canton:testnet`.
`signingProviders.blockdaemon.apiKeyEnv`	no	Name of the env var that holds the API key. Defaults to `BLOCKDAEMON_API_KEY`.

Environment variable	Required	Description
`BLOCKDAEMON_API_KEY`	yes	Blockdaemon API key. Override name with `apiKeyEnv`.

DFNS

Programmable, MPC-based key management and signing from DFNS. Keys are managed in DFNS’ secure infrastructure. Complete the setup from the DFNS signing documentation. Set up a service account with appropriate permissions and download its credentials, then set the following config fields and environment variables:

Config field	Required	Description
`signingProviders.dfns`	yes	Include this object to opt in.
`signingProviders.dfns.orgId`	yes	Dfns organization ID.
`signingProviders.dfns.credId`	yes	Dfns service account credential ID.
`signingProviders.dfns.baseUrl`	no	Dfns API URL. Defaults to `https://api.dfns.io`.
`signingProviders.dfns.privateKeyEnv`	no	Name of the env var that holds the private key. Defaults to `DFNS_PRIVATE_KEY`.
`signingProviders.dfns.authTokenEnv`	no	Name of the env var that holds the auth token. Defaults to `DFNS_AUTH_TOKEN`.

Environment variable	Required	Description
`DFNS_PRIVATE_KEY`	yes	Service account private key (PEM). Override name with `privateKeyEnv`.
`DFNS_AUTH_TOKEN`	yes	Service account auth token. Override name with `authTokenEnv`.

Securosys

HSM-backed key management and signing through Securosys TSB (Transaction Security Broker). See the Securosys signing documentation for authentication modes (API keys, bearer token, and/or mTLS).

Config field	Required	Description
`signingProviders.securosys`	yes	Include this object to opt in. Requires `baseUrl`.
`signingProviders.securosys.baseUrl`	yes	TSB service URL.
`signingProviders.securosys.mtlsP12Path`	no	Path to a PKCS#12 client certificate when TSB requires mTLS.
`signingProviders.securosys.signatureAlgorithm`	no	TSB signature algorithm. Defaults to `EDDSA`.
`signingProviders.securosys.keyManagementApiKeyEnv`	no	Name of the env var that holds the key-management API key. Defaults to `SECUROSYS_TSB_KEY_MANAGEMENT_API_KEY`.
`signingProviders.securosys.keyOperationApiKeyEnv`	no	Name of the env var that holds the key-operation API key. Defaults to `SECUROSYS_TSB_KEY_OPERATION_API_KEY`.
`signingProviders.securosys.bearerTokenEnv`	no	Name of the env var that holds the bearer token. Defaults to `SECUROSYS_TSB_BEARER_TOKEN`.
`signingProviders.securosys.mtlsP12PasswordEnv`	no	Name of the env var that holds the PKCS#12 password. Defaults to `SECUROSYS_TSB_MTLS_P12_PASSWORD`.
`signingProviders.securosys.keyPasswordEnv`	no	Name of the env var that holds the TSB key password. Defaults to `SECUROSYS_TSB_KEY_PASSWORD`.

Environment variable	Required	Description
`SECUROSYS_TSB_KEY_MANAGEMENT_API_KEY`	no	API key for TSB key-management endpoints. Override name with `keyManagementApiKeyEnv`.
`SECUROSYS_TSB_KEY_OPERATION_API_KEY`	no	API key for TSB signing and request-status endpoints. Override name with `keyOperationApiKeyEnv`.
`SECUROSYS_TSB_BEARER_TOKEN`	no	Bearer access token for access-token auth. Override name with `bearerTokenEnv`.
`SECUROSYS_TSB_MTLS_P12_PASSWORD`	no	Password for the PKCS#12 client certificate. Override name with `mtlsP12PasswordEnv`.
`SECUROSYS_TSB_KEY_PASSWORD`	no	TSB key password used for key attributes and signing. Override name with `keyPasswordEnv`.

BitGo

MPC custodial signing through BitGo. See the BitGo signing documentation.

Config field	Required	Description
`signingProviders.bitgo`	yes	Include this object to opt in.
`signingProviders.bitgo.baseUrl`	no	API base URL. Defaults to `https://app.bitgo.com`. Use `https://app.bitgo-test.com` for testnet.
`signingProviders.bitgo.enterpriseId`	no	Enterprise ID. Required for wallet creation and restart-safe transaction lookup.
`signingProviders.bitgo.coin`	no	Canton coin identifier. Auto-detected from the API URL when omitted (`tcanton` for testnet, `canton` otherwise).
`signingProviders.bitgo.accessTokenEnv`	no	Name of the env var that holds the access token. Defaults to `BITGO_ACCESS_TOKEN`.

Environment variable	Required	Description
`BITGO_ACCESS_TOKEN`	yes	BitGo access token. Override name with `accessTokenEnv`.

​Configuration

​Available providers

​Internal

​Participant

​Fireblocks

​Blockdaemon

​DFNS

​Securosys

​BitGo

Configuration

Available providers

Internal

Participant

Fireblocks

Blockdaemon

DFNS

Securosys

BitGo