Custody and Signing Authority
Paymento Embedded Wallet is designed so that the merchant controls authorization of wallet transactions.
Paymento can create the wallet environment, generate receiving information, monitor payments, and prepare transactions. It cannot independently authorize or sign a transfer from the merchant’s Embedded Wallet.
Built on Turnkey
Paymento uses Turnkey as the wallet infrastructure provider for Embedded Wallet.
Private keys are generated and protected within Turnkey’s secure infrastructure. During normal wallet operation, raw private keys are not exposed to Paymento. Instead, Turnkey evaluates the wallet’s authentication and authorization policies before producing a transaction signature.
Paymento does not hold a private-key share or recovery credential that allows it to bypass merchant authorization.
Who controls signing?
The merchant is the signing authority for the Embedded Wallet.
Sensitive wallet actions require authentication using the merchant’s registered passkey. Paymento’s service credentials are not authorized to independently sign transactions or create merchant signing authorization.
This distinction is important:
Paymento can prepare a transaction request.
Paymento can display the amount, asset, network, destination, and estimated network cost.
The merchant must authenticate and authorize the wallet action.
Paymento cannot initiate a valid transfer without that merchant authorization.
What Paymento can do
Paymento can perform operational tasks that do not independently move funds, including:
Create the Embedded Wallet environment
Generate or assign receiving addresses
Monitor supported blockchain networks
Detect and confirm incoming payments
Display wallet balances and payment history
Prepare settlement and refund transaction requests
Broadcast an authorized transaction
Track an authorized transaction to confirmation
These capabilities allow Paymento to operate checkout and payment monitoring without possessing independent signing authority.
What Paymento cannot do
Paymento cannot independently:
Sign a wallet transaction
Transfer merchant funds
Settle funds without merchant authorization
Issue a wallet-based refund without merchant authorization
Add itself as a merchant signing credential
Replace the merchant’s signing authority
Recover a lost merchant authenticator using a Paymento-held recovery credential
What Turnkey can and cannot do
Turnkey provides the secure infrastructure that protects key material and evaluates wallet policies.
Turnkey does not independently decide to move merchant funds. A transaction signature is produced only when the configured authentication and authorization requirements are satisfied.
Turnkey’s role as the wallet infrastructure provider does not give Paymento independent control of the merchant’s wallet.
How authorization works
When a merchant settles funds or sends a supported wallet-based refund:
Paymento prepares the transaction request.
The merchant reviews the relevant transaction details.
Paymento performs any required account-level verification.
The merchant authorizes the wallet action using the registered passkey.
The authorized transaction is signed and submitted to the relevant blockchain.
Paymento tracks the transaction and displays its status.
A merchant authorization may support multiple related transactions within one settlement operation. It does not give Paymento permanent or unrestricted authority over the wallet.
Settlement destinations
Settlement funds can be sent only to an eligible destination configured for the store.
Before approving settlement, merchants should verify:
The destination address
The blockchain network
The asset being settled
The amount
The expected network cost
Blockchain transactions are generally irreversible. Paymento cannot reverse a correctly signed transaction sent to an incorrect merchant-configured address.
See Settlement for the merchant settlement process.
Can Paymento freeze funds?
Paymento cannot seize or independently transfer merchant-controlled on-chain funds.
However, custody of funds and access to Paymento’s software are different matters. Paymento may restrict access to its dashboard, checkout, monitoring, API, or settlement interface in accordance with its Terms of Service, security policies, legal obligations, or account restrictions.
Restricting access to Paymento’s services does not transfer ownership of the underlying on-chain assets to Paymento.
What this model protects against
The Embedded Wallet authorization model is designed to prevent Paymento, its employees, or a party possessing only Paymento’s ordinary service credentials from independently signing wallet transactions.
It does not protect against every possible risk. Merchants remain responsible for:
Protecting the registered passkey and its provider account
Securing devices used to authorize wallet actions
Reviewing transaction details before approval
Protecting the configured settlement wallet
Maintaining available backup and recovery methods
Responding promptly if an authenticator or device may be compromised
Merchant authorization should never be approved without reviewing the destination and transaction details.
Reporting a concern
If you believe a wallet action occurred without your authorization, or you identify behavior that contradicts this page:
Do not approve any additional wallet requests.
Preserve relevant transaction hashes, timestamps, and screenshots.
Contact Paymento Support immediately.
For security vulnerabilities, follow Paymento’s published vulnerability-disclosure process.
Last updated