Skip to main content

How Privy Enables Deploy.Finance Wallets

Deploy.Finance's wallet infrastructure is enabled by Privy.io, a leading class solution provider of authentication and wallet infrastructure.

Privy builds authentication and wallet infrastructure to enable better products built on crypto rails. Get started in minutes to onboard users with wallets, spin up self-custodial wallets for users, and securely sign transactions through your app.

Deploy.Finance's agents and infrastructure leverage Privy to generate wallets with private keys and sign transactions for delegation and withdraw activities.

Private key generation​

Privy generates private keys using distributed key sharding with Shamir's Secret Sharing (SSS). Each key is split into encrypted shares stored across separate security boundaries.

The process uses:

  • Three share types. Device or enclave share (stored on the user's device or TEE), auth share (stored by Privy), and recovery share (user-managed or Privy-backed).
  • Open-source cryptography. Audited shamir-secret-sharing library, the most widely used open-source Typescript implementation of SSS.

Key management architecture​

  1. Secure assembly. Private keys are only temporarily reconstructed within secure execution environments when exactly two shares are present.
  2. Storage isolation. Web clients store the device share in the browser's domain-partitioned local storage. API integrations use a TEE as a remote device.
  3. Export controls. Private key exports require explicit policy permission via HPKE-encrypted API.

Session management​

Privy enables secure delegation of smart wallet activities through session keys, using cryptographic controls and trusted execution environments.

You submit a request (such as "Delegate funds to DD NOS"), triggering a delegation request that requires explicit user approval through Privy's client SDK. A cryptographic proof of consent is generated and stored on-chain or in secure storage.

2. Key provisioning​

Privy's API creates a session key pair within a Trusted Execution Environment (TEE), splitting the private key using Shamir's Secret Sharing. One share is stored in the TEE. One share is encrypted with user credentials. One share is held by Privy's infrastructure.

3. Secure key assembly​

When needed, the session key is temporarily reconstructed in the TEE using HPKE-encrypted API calls.

The session key remains active until you revoke access. Learn more about Privy's security architecture.