Skip to main content
This guide covers the production patterns for Company Wallets after you finish the quickstart. Create API-only users with createApiOnlyUsers, then stamp all server calls with that keypair via @0xkey-io/sdk-server.

​
Policy + consensus

  1. Prefer narrow allow policies (recipient / selector / chain / value).
  2. Add consensus for high-value paths (approvers.count() >= 2).
  3. Use Policy simulate in the Dashboard before enabling automation.
  4. Root quorum (updateRootQuorum) gates org-level sensitive changes — separate from per-activity consensus.
Templates: Policy templates.

​
Custodial send matrix

Always fail closed when RPC providers are unavailable — do not treat empty statuses as success.

​
Webhooks

Subscribe to activity and send-transaction status updates for ops automation. Verify signatures via the public JWKS endpoint. See Webhooks.

​
Import / export

HPKE-protected import/export is available on all plans (key_export is not a paid-tier gate). Use Dashboard import or server SDK export flows; never log plaintext mnemonics. Protocol: see technical design B3 / frames export UIs.

​
Attestation checklist

Before production:
  1. Call getAttestationDocument (or boot/app proof APIs) against your target environment.
  2. Verify with @0xkey-io/crypto helpers (verifyAttestationDocument / boot proof verify).
  3. Pin expected PCR / manifest values from your ceremony release notes.
Details: Remote attestation.

​
Hybrid end-user + backend co-sign

If you need end-user passkey and backend API key (2/2), that is a hybrid / Embedded-adjacent pattern — not the default Company Wallets path. See Hybrid co-signing.

​
Language SDKs

​
Migration from Turnkey

Public docs do not ship a one-click Turnkey migration funnel. Enterprise customers can request private migration assistance via hello@0xkey.io. Policy DSL is not 1:1 with CEL — expect conversion and review.