Manage Wallet Signers

A wallet's signer set is the list of keys CRE Connect will accept signatures from when executing operations against the wallet's Smart Account. The set is typed: ecdsa wallets accept EVM addresses, rsa wallets accept RSA public keys.

What can be configured today

Set the signer set at creation time

StatusChannelId is optional on Create (the SDK rejects a zero-UUID value with wallets.ErrStatusChannelIDZero); pass the channel where you want wallet.status events to land.

ECDSA wallet:

import (
    "github.com/smartcontractkit/crec-sdk/wallets"
    apiClient "github.com/smartcontractkit/crec-api-go/client"
)

statusChannelID := channelID // any channel you own
ecdsaSigners := []string{
    "0x1111111111111111111111111111111111111111",
    "0x2222222222222222222222222222222222222222",
}

w, err := client.Wallets.Create(ctx, wallets.CreateInput{
    Name:                "treasury-eth",
    ChainSelector:       "5009297550715157269",
    WalletOwnerAddress:  "0xYourOwnerEOA",
    WalletType:          apiClient.Ecdsa,
    AllowedEcdsaSigners: &ecdsaSigners,
    StatusChannelId:     &statusChannelID,
})

RSA wallet:

rsaSigners := apiClient.RSASignersList{
    // E and N are 0x-prefixed hex strings (validated by the API regex
    // `^0x[a-fA-F0-9]{2,34}$` for `e` and `^0x[a-fA-F0-9]{512,}$` for `n`).
    // E is typically `0x010001` (= 65537). N is at least 2048 bits = 512 hex chars.
    {E: "0x010001", N: "0xc2a8...hex-encoded-modulus..."},
}

w, err := client.Wallets.Create(ctx, wallets.CreateInput{
    Name:               "rsa-treasury-eth",
    ChainSelector:      "5009297550715157269",
    WalletOwnerAddress: "0xYourOwnerEOA",
    WalletType:         apiClient.Rsa,
    AllowedRsaSigners:  &rsaSigners,
    StatusChannelId:    &statusChannelID,
})

Service limits enforced by the API (RSASignersList / ECDSASignersList schemas, maxItems: 10): maximum 10 ECDSA signers and maximum 10 RSA signers per wallet.

Read the current signer set

w, err := client.Wallets.Get(ctx, walletID)
if err != nil { return err }

if w.AllowedEcdsaSigners != nil {
    for _, addr := range *w.AllowedEcdsaSigners {
        fmt.Println("ecdsa signer:", addr)
    }
}
if w.AllowedRsaSigners != nil {
    for _, k := range *w.AllowedRsaSigners {
        fmt.Println("rsa signer:", k.E, k.N)
    }
}

curl:

curl -sS "$CREC_BASE_URL/wallets/$WALLET_ID" \
  -H "Authorization: Apikey $CREC_API_KEY" \
  | jq '{allowed_ecdsa_signers, allowed_rsa_signers}'

Changing the signer set after creation

The signer set is fixed at creation. To use a different signer set, provision a new wallet with Wallets.Create and (when the old wallet is no longer needed) archive it with Wallets.Archive. Both APIs are the same ones documented above.

Choosing signer addresses up front

When you call Wallets.Create you don't pass a signer.Signer instance: you pass the address (ECDSA) or {e, n} pair (RSA) that signer will produce. Each per-provider guide documents the exact helper to use:

• Local Signer: crypto.PubkeyToAddress(privateKey.PublicKey).
• AWS KMS Signer: awskms.GetPubKeyCtx(ctx, client, keyID) then crypto.PubkeyToAddress.
• HashiCorp Vault Signer: s.Public() for ECDSA keys; s.GetRSAModulus() for RSA keys.
• Fireblocks Signer: s.GetVaultAccountAddress(ctx).
• Privy Signer: s.GetWalletAddress(ctx).

For RSA signers the modulus n and exponent e must be 0x-prefixed hex strings, validated by the API regex ^0x[a-fA-F0-9]{2,34}$ for e and ^0x[a-fA-F0-9]{512,}$ for n (i.e. ≥ 2048-bit modulus). The Vault helper GetRSAModulus() returns hex without the 0x prefix; prepend it before passing the value to wallets.Create.

Sentinel errors

Next steps

• Local Signer: generate an ECDSA address from a private key for testing.
• AWS KMS Signer: derive an address from a KMS-held key for production.
• Smart Accounts: what the signer set protects.