Move money globally with fewer barriers
Use embedded stablecoins to enable faster, always-on payments and transfers across markets.
The permissionless embedded wallet you own.
Stop renting your user layer from middlemen. Let customers hold, move, and spend stablecoins directly in your existing product experience. Fully non-custodial, with no API keys, paymasters, middlemen, or rent fees.
Install the skill to guide your coding agent
npx skills add 1Shot-API/skills/1shot-walletConnecting to wallet…
Embedded wallet infrastructure for product teams
Ship passkey-native accounts, stablecoin balances, and agent permissions without renting a closed user layer from a wallet vendor. Learn what an embedded wallet is.
Automate transactions without losing control
Delegate account actions to users, teams, and AI agents with precise permissions, limits, and enterprise policies.
Reduce identity friction and compliance costs
Verify customers once and reuse portable credentials across products, markets, and providers.
Go onchain immediately — no purchase necessary.
There is no developer account or subscription required to scale. Just import the 1Shot provider package and customize the look and feel for your product.
- No API keys, MAU tiers or wallet signature fees
- Users can access the same onchain account between apps, increasing network effects
- Compatible with all blockchain networks
- Works with standard Web3 libraries like viem and ethers
embed-wallet.ts
import { OWSProxy } from "@1shotapi/ows-provider"; // No dev accounts or API key, just use the wallet iframeconst WALLET_URL = "https://wallet.1shotapi.com/"; const container = document.getElementById( "wallet-container")!;const proxy = await OWSProxy.create( container, WALLET_URL,); // Optional themingawait proxy.rpc("setStyle", { copy: { productName: "Acme Wallet" }, theme: { primary: "#239aaa" },}); proxy.showWallet(); const accounts = await proxy.ethereum.request({ method: "eth_requestAccounts",});Issue OpenID-compliant credentials to the wallet.
Credentials live with the user. Progressive disclosure means they only reveal what a verifier actually needs.
- Issue verifiable credentials to a user’s wallet they can take to any verifier
- Progressive disclosure — users have control to only reveal what’s necessary
Accept credential offer?
1shotapi.com (https://1shotapi.com/playground/issuer) wants to issue a credential to your wallet.
Offered credentials:
- KycCredential (vc+sd-jwt) — kyc
You may be asked to verify with your passkey after you continue.
Outcome-scoped permissions for agents.
EIP-7710 delegations let agents execute strategies when users are offline — bounded by onchain enforcers.
- EIP-7710 delegations enable modular, outcome-scoped permissioning
- Execute strategies when users are offline, protected by onchain enforcers
EIP-7715 Permission
wallet.1shotapi.com
Amount25.00 USDC
Transfer windowDaily
Account
Alice's Wallet
JustificationClawdBot stablecoin budget
Networks
Ethereum·
Arc
Start date04/20/2026 14:00
Expiration date06/07/2026 15:00
Pay gas in the stablecoins users already hold.
Sponsor transactions for your users, or let them pay from their own USDC, USDT, USDG, or mUSD balances.
- Transactions can be paid in popular stablecoins (USDC, USDT, USDG, mUSD)
- Sponsor transactions for your users or let them pay from their own stablecoin holdings
Network fee
Pay with
ETH
Balance: 0.000346 ETH
USDC
Balance: 67.42 USDC
USDG
Balance: 47.30 USDG
USDT
Balance: 20.65 USDT
Network speed
Slow
0.90 Gwei
1 min
0.000031 ETH≈ 0.07 USDC
Average
1.49 Gwei
30 sec
0.000051 ETH≈ 0.12 USDC
Fast
2.69 Gwei
15 sec
0.000093 ETH≈ 0.21 USDC
Host → Branding → Signing
The hosted 1Shot Wallet is an Open Wallet Standard stack. Same-origin Branding and Signing under wallet.1shotapi.com. The Host never embeds /signer/.
Host
Your dapp
Embeds Branding with OWSProxy. EIP-1193, credentials RPC, and setStyle. Never embeds Signing.
Branding
wallet.1shotapi.com
Product UX, consent modals, theming, and credential UI. Talks to Signing — holds no private keys.
Signing
/signer/
PRF custody kernel; 0 external dependencies. Passkey → HKDF → secp256k1. Signs digests. Accepts postMessage only from its nested parent.
Integrate the hosted wallet — don’t rebuild PRF
Your app wires @1shotapi/ows-provider. Passkey custody stays inside 1Shot’s Signing Layer.
01
Embed Branding
OWSProxy.create(container, "https://wallet.1shotapi.com/") — Host points at the Branding root only.
02
Theme with setStyle
Optional product name, colors, and copy merge into the Branding Layer before you show the flyout.
03
Passkey + PRF in Signing
Unlock and sign ceremonies run inside the Signing Layer. Challenges are generated client-side there — not by your backend.
04
EIP-1193 to your app
Host receives addresses and signatures only via ethereum.request — never private keys or PRF output.
Where keys live — and where they don’t
The Signing Layer iframe derives and signs with keys client side. 1Shot can never access user private keys.
Signing · custody
- Passkey + PRF ceremony
- HKDF → secp256k1
- signDigest
Branding · UX
- Consent & setStyle UI
- Address / credential cache
- Account Recovery Flows
Host · your app
- EIP-1193 results
- Addresses + signatures only
Security positioning
- Signing Layer: PRF → HKDF → secp256k1 (and ed25519); signDigest; WebAuthn challenges via crypto.getRandomValues.
- Branding Layer: consent UI and robust mobile-optimized user-focus state handling, address/credential-id cache, user-friendly recovery flows — no private keys.
- Host Layer: addresses and signatures only. XSS in the Host cannot reach Signing postMessage — iframe isolation via the OWS three-layer stack.
- 1Shot handles storing encrypted OID4 credentials - not wallet private keys.
A real EVM key — not a smart-wallet workaround.
WebAuthn PRF inside the Signing Layer derives a native secp256k1 EVM private key— the same curve MetaMask, hardware wallets, and every EVM tool already speak. Not a P-256 key that forces a smart-contract wallet and on-chain signature validation.
Sign as a standard EOA and broadcast via public RPCs. Gas abstraction comes built-in via the 1Shot public relayer so users can transact with stablecoins they already have.
- Standard EOA — no per-user smart-contract deploy on first transaction
- Signatures verify natively in any EVM contract, on any chain
- Drop-in with public RPCs and standard wallet connectors (viem, ethers)
- No P-256 precompile dependency or custom validation contracts for basic sends
Connect & sign at a glance
Host talks to Branding. Branding nests Signing. No wallet-auth server on the PRF path.
1Shotting the competition
No MAU fees. No user-op fees. Portable credentials by default.
Privy account portability requires provider approval and user consent per their global wallets program. Learn what embedded wallets are. For a deeper vendor and economics breakdown, see our embedded wallet alternatives analysis.
FAQ
Embedded wallet questions from enterprise teams
Evaluating embedded wallets or planning a security review? Start here — then explore Architecture and the passkey wallet quickstart.
- What is an embedded wallet, and how is 1Shot different from Privy or Thirdweb?
- An embedded wallet lives inside your product so users never install a browser extension. 1Shot Wallet is permissionless infrastructure: embed via OWSProxy with no vendor API key, no MAU tiers, and portable passkey-derived accounts by default — unlike Privy or Thirdweb, which meter users and gate cross-app portability.
- Is 1Shot Wallet non-custodial? Where are private keys stored?
- Yes. Private keys are derived client-side inside the isolated Signing Layer from a WebAuthn passkey PRF. Your Host app receives addresses and signatures via cross-origin postMessage — never key material.
- Do we need a vendor contract, API keys, or MAU pricing to integrate?
- No. Embed wallet.1shotapi.com with @1shotapi/ows-provider and start in the playground. There is no developer account gate, no per-MAU billing, and no per-signature metering on the wallet layer. You can contact the 1Shot team at info@1shotapi.com for support or SLA inquiries.
- Can we white-label the wallet UX in our product?
- Yes. Use Host RPC setStyle to merge your product name, colors, and copy into the Branding Layer before users see consent modals or account screens — so the wallet feels native to your fintech or Web3 app.
- How does account portability work across apps?
- Users control a passkey-derived EOA that is not locked to a single vendor dashboard. The same onchain identity can move between integrator apps that embed 1Shot Wallet, with portable verifiable credentials issued under OpenID standards.
- How long does integration typically take?
- Most product teams ship a working embed in a day: OWSProxy in the Host, setStyle for branding, and eth_requestAccounts for connect. Pair with the passkey-wallet quickstart and the 1shot-wallet agent skill for guided implementation.
- How does this fit with our security review (iframe isolation, OWS layers)?
- 1Shot Wallet uses the Open Wallet Standard three-layer stack (Host → Branding → Signing). XSS in your Host cannot reach Signing postMessage. Passkey ceremonies and PRF derivation run only inside the nested Signing iframe on wallet.1shotapi.com.
See it in action
Stop renting your user layer.
The first and only permissionless embedded wallet. Never worry about hitting your user limit again.
Install the 1Shot Wallet skill
npx skills add 1Shot-API/skills/1shot-wallet