Keys and recovery
Self-custodial from the first note — without a single-phone cliff.
Status: design. XEROPAY is being built. These pages describe intended behaviour. Nothing here is claimed as live mainnet. Details can change. See What's live.
Spending key
Generated and kept on your device. XEROPAY cannot move funds or decrypt notes on your behalf. If we could, this would be a hosted wallet with extra adjectives.
Passkeys and hardware
Passkeys are the intended daily opener. Hardware wallets are for people who already live there. Neither is a back door for us.
Guardians
A lost phone is not designed to be a lost account. Guardians help recover the spending path. They are not supposed to receive a standing viewing key unless you issue one.
Gas sponsorship
A paymaster is designed to cover network fees so you are not forced to hold a public gas token beside private funds. See Wallet and network.
Local tax export
CSV or PDF generated on your machine from a viewing key you issued. The server does not assemble your tax year.