Skip to main content
A Server Wallet is a non-custodial OMS wallet that your backend controls through its own OIDC identity. There is no end user to authenticate and no client application in the signing path. Your application custodies the wallet and its funds. Signing keys are generated inside the WaaS enclave and never leave it, and every operation requires an authorization from the identity your backend holds.

​
When to use Server Wallets

Choose Server Wallets when your product moves funds on its own behalf rather than on behalf of a signed-in user: treasury operations, automated payouts, settlement, and scheduled transfers.

​
Identity and wallet mapping

Your backend authenticates with three values: an issuer, an audience, and a subject. The subject is an immutable application identifier that you choose. One subject maps to one EVM wallet. That wallet has the same address on every supported network, so you do not track a separate address per chain. Server Wallets run on the same networks as the rest of OMS wallets. See Supported networks.

​
What your backend provides

Server Wallets move three responsibilities into your infrastructure. Confirm you can meet all three before you start:
  1. An OIDC issuer that you host. It issues ES256 ID tokens for your subject and is registered with your OMS project. Your backend, not OMS, decides when to issue a token, which is what makes the wallet yours to authorize.
  2. Encrypted durable storage. The SDK persists wallet credentials and request nonces through a storage interface you implement. Writes must be durable before they resolve.
  3. Exclusive per-wallet execution. Two processes must never operate the same wallet concurrently. A single process satisfies this with the SDK’s serial executor; a clustered backend needs a coordinator that holds exclusive ownership across processes.

​
Capabilities

  • Native and ERC-20 transfers, which require a sponsored quote. See Gas Sponsorship.
  • Same-chain and cross-chain swaps, with quote review before any funds move. See swaps.
  • Plain-message signing, verified against the wallet.
  • EIP-712 typed-data signing, with the domain and data validated before signing.
  • Balance reads for any address, which need no authenticated wallet.

Server Wallet SDK quickstart

Install the TypeScript SDK, restore your wallet, and send a sponsored transfer.