Fintech & neobank onboarding
Onboard retail and business users with passkey-secured stablecoin accounts — no extension, no seed phrase support burden.
The permissionless embedded wallet you own.
Stop renting your user layer from middlemen. Ship a customizable, fully non-custodial embedded wallet experience with no API keys, MAU overhead or user op fees — built for fintech, neobank, and Web3 product teams.
Install the skill to guide your coding agent
npx skills add 1Shot-API/skills/1shot-walletConnecting to wallet…
Enterprise use cases
Embedded wallet infrastructure for product teams
Ship passkey-native accounts, stablecoin balances, and agent permissions without renting a closed user layer from a wallet vendor.
Marketplaces & loyalty
Hold USDC, USDT, and other stablecoins in-product and pay network fees from balances users already hold via built-in gas abstraction.
Agent-native apps
Grant outcome-scoped EIP-7710 delegations so agents execute when users are offline, bounded by onchain enforcers.
Identity & KYC flows
Issue OpenID-compliant verifiable credentials to the wallet with progressive disclosure — users reveal only what verifiers need.
Permissionless Integration
Go onchain immediately — no purchase necessary.
Ship a seamless native wallet experience in your product with no API keys, no MAU fees and no per-user op metering.
- No API keys, MAU tiers or wallet signature fees
- Users can access the same onchain account between apps, increasing network effects
- Compatible with all blockchain networks
- Works with standard Web3 libraries like viem and ethers
embed-wallet.ts
import { OWSProxy } from "@1shotapi/ows-provider"; // No dev accounts or API key, just use the wallet iframeconst WALLET_URL = "https://wallet.1shotapi.com/"; const container = document.getElementById( "wallet-container")!;const proxy = await OWSProxy.create( container, WALLET_URL,); // Optional themingawait proxy.rpc("setStyle", { copy: { productName: "Acme Wallet" }, theme: { primary: "#239aaa" },}); proxy.showWallet(); const accounts = await proxy.ethereum.request({ method: "eth_requestAccounts",});Portable Verifiable Credentials
Issue OpenID-compliant credentials to the wallet.
Credentials live with the user. Progressive disclosure means they only reveal what a verifier actually needs.
- Issue verifiable credentials to a user’s wallet they can take to any verifier
- Progressive disclosure — users have control to only reveal what’s necessary
Accept credential offer?
1shotapi.com (https://1shotapi.com/playground/issuer) wants to issue a credential to your wallet.
Offered credentials:
- KycCredential (vc+sd-jwt) — kyc
You may be asked to verify with your passkey after you continue.
Agent Ready
Outcome-scoped permissions for agents.
EIP-7710 delegations let agents execute strategies when users are offline — bounded by onchain enforcers.
- EIP-7710 delegations enable modular, outcome-scoped permissioning
- Execute strategies when users are offline, protected by onchain enforcers
EIP-7715 Permission
wallet.1shotapi.com
Amount25.00 USDC
Transfer windowDaily
Account
Alice's Wallet
JustificationClawdBot stablecoin budget
Networks
Ethereum·
Arc
Start date04/20/2026 14:00
Expiration date06/07/2026 15:00
Built-in Gas Abstraction
Pay gas in the stablecoins users already hold.
Sponsor transactions for your users, or let them pay from their own USDC, USDT, USDG, or mUSD balances.
- Transactions can be paid in popular stablecoins (USDC, USDT, USDG, mUSD)
- Sponsor transactions for your users or let them pay from their own stablecoin holdings
Network fee
Pay with
ETH
Balance: 0.000346 ETH
USDC
Balance: 67.42 USDC
USDG
Balance: 47.30 USDG
USDT
Balance: 20.65 USDT
Network speed
Slow
0.90 Gwei
1 min
0.000031 ETH≈ 0.07 USDC
Average
1.49 Gwei
30 sec
0.000051 ETH≈ 0.12 USDC
Fast
2.69 Gwei
15 sec
0.000093 ETH≈ 0.21 USDC
Three-layer model
Host → Branding → Signing
The hosted 1Shot Wallet is an Open Wallet Standard stack. Same-origin Branding and Signing under wallet.1shotapi.com. The Host never embeds /signer/.
Host
Your dapp
Embeds Branding with OWSProxy. EIP-1193, credentials RPC, and setStyle. Never embeds Signing.
Branding
wallet.1shotapi.com
Product UX, consent modals, theming, and credential UI. Talks to Signing — holds no private keys.
Signing
/signer/
PRF custody kernel. Passkey → HKDF → secp256k1. Signs digests. Accepts postMessage only from its nested parent.
How it works
Integrate the hosted wallet — don’t rebuild PRF
Your app wires @1shotapi/ows-provider. Passkey custody stays inside 1Shot’s Signing Layer.
01
Embed Branding
OWSProxy.create(container, "https://wallet.1shotapi.com/") — Host points at the Branding root only.
02
Theme with setStyle
Optional product name, colors, and copy merge into the Branding Layer before you show the flyout.
03
Passkey + PRF in Signing
Unlock and sign ceremonies run inside the Signing Layer. Challenges are generated client-side there — not by your backend.
04
EIP-1193 to your app
Host receives addresses and signatures only via ethereum.request — never private keys or PRF output.
Trust boundary
Where keys live — and where they don’t
Only the Signing Layer derives and uses private keys. Branding is UX. Host gets signatures.
Signing · custody
- Passkey + PRF ceremony
- HKDF → secp256k1
- signDigest
Branding · UX
- Consent & setStyle UI
- Address / credential cache
- Backup ciphertext (local)
Host · your app
- EIP-1193 results
- Addresses + signatures only
Security positioning
- Signing Layer: PRF → HKDF → secp256k1 (and ed25519); signDigest; WebAuthn challenges via crypto.getRandomValues.
- Branding Layer: consent UI, address/credential-id cache, encrypted backup ciphertext in Branding localStorage — no private keys.
- Host Layer: addresses and signatures only. XSS in the Host cannot reach Signing postMessage — iframe isolation via the OWS three-layer stack.
- Relayer may store encrypted OID4 credential blobs — not wallet private keys.
Native EVM, out of the box
A real EVM key — not a smart-wallet workaround.
WebAuthn PRF inside the Signing Layer derives a native secp256k1 EVM private key— the same curve MetaMask, hardware wallets, and every EVM tool already speak. Not a P-256 key that forces a smart-contract wallet and on-chain signature validation.
Sign as a standard EOA and broadcast via public RPCs. Gas abstraction via the public relayer is complementary — Architecture here is custody and Host integration.
- Standard EOA — no per-user smart-contract deploy on first transaction
- Signatures verify natively in any EVM contract, on any chain
- Drop-in with public RPCs and standard wallet connectors (viem, ethers)
- No P-256 precompile dependency or custom validation contracts for basic sends
Sequence flow
Connect & sign at a glance
Host talks to Branding. Branding nests Signing. No wallet-auth server on the PRF path.
Comparison at a glance
1Shotting the competition
No MAU fees. No user-op fees. Portable credentials by default.
Privy account portability requires provider approval and user consent per their global wallets program. For a deeper vendor and economics breakdown, see our embedded wallet alternatives analysis.
FAQ
Embedded wallet questions from enterprise teams
Evaluating a Privy alternative or planning a security review? Start here — then explore Architecture and the passkey wallet quickstart.
- What is an embedded wallet, and how is 1Shot different from Privy or Thirdweb?
- An embedded wallet lives inside your product so users never install a browser extension. 1Shot Wallet is permissionless infrastructure: embed via OWSProxy with no vendor API key, no MAU tiers, and portable passkey-derived accounts by default — unlike Privy or Thirdweb, which meter users and gate cross-app portability.
- Is 1Shot Wallet non-custodial? Where are private keys stored?
- Yes. Private keys are derived client-side inside the isolated Signing Layer from a WebAuthn passkey PRF. Your Host app receives addresses and signatures via cross-origin postMessage — never key material.
- Do we need a vendor contract, API keys, or MAU pricing to integrate?
- No. Embed wallet.1shotapi.com with @1shotapi/ows-provider and start in the playground. There is no developer account gate, no per-MAU billing, and no per-signature metering on the wallet layer. You can contact the 1Shot team at info@1shotapi.com for support or SLA inquiries.
- Can we white-label the wallet UX in our product?
- Yes. Use Host RPC setStyle to merge your product name, colors, and copy into the Branding Layer before users see consent modals or account screens — so the wallet feels native to your fintech or Web3 app.
- How does account portability work across apps?
- Users control a passkey-derived EOA that is not locked to a single vendor dashboard. The same onchain identity can move between integrator apps that embed 1Shot Wallet, with portable verifiable credentials issued under OpenID standards.
- How long does integration typically take?
- Most product teams ship a working embed in a day: OWSProxy in the Host, setStyle for branding, and eth_requestAccounts for connect. Pair with the passkey-wallet quickstart and the 1shot-wallet agent skill for guided implementation.
- How does this fit with our security review (iframe isolation, OWS layers)?
- 1Shot Wallet uses the Open Wallet Standard three-layer stack (Host → Branding → Signing). XSS in your Host cannot reach Signing postMessage. Passkey ceremonies and PRF derivation run only inside the nested Signing iframe on wallet.1shotapi.com.
See it in action
Stop renting your user layer.
The first and only permissionless embedded wallet. Never pay for MAUs or user ops again.
Install the 1Shot Wallet skill
npx skills add 1Shot-API/skills/1shot-wallet