> For the complete documentation index, see [llms.txt](https://docs.paymento.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.paymento.io/embedded-wallet/custody-and-signing-authority.md). # Custody and Signing Authority Paymento Embedded Wallet is designed so that the merchant controls authorization of wallet transactions. Paymento can create the wallet environment, generate receiving information, monitor payments, and prepare transactions. It cannot independently authorize or sign a transfer from the merchant’s Embedded Wallet. ### Built on Turnkey Paymento uses [Turnkey](https://www.turnkey.com/) as the wallet infrastructure provider for Embedded Wallet. Private keys are generated and protected within Turnkey’s secure infrastructure. During normal wallet operation, raw private keys are not exposed to Paymento. Instead, Turnkey evaluates the wallet’s authentication and authorization policies before producing a transaction signature. Paymento does not hold a private-key share or recovery credential that allows it to bypass merchant authorization. ### Who controls signing? The merchant is the signing authority for the Embedded Wallet. Sensitive wallet actions require authentication using the merchant’s registered passkey. Paymento’s service credentials are not authorized to independently sign transactions or create merchant signing authorization. This distinction is important: * Paymento can prepare a transaction request. * Paymento can display the amount, asset, network, destination, and estimated network cost. * The merchant must authenticate and authorize the wallet action. * Paymento cannot initiate a valid transfer without that merchant authorization. ### What Paymento can do Paymento can perform operational tasks that do not independently move funds, including: * Create the Embedded Wallet environment * Generate or assign receiving addresses * Monitor supported blockchain networks * Detect and confirm incoming payments * Display wallet balances and payment history * Prepare settlement and refund transaction requests * Broadcast an authorized transaction * Track an authorized transaction to confirmation These capabilities allow Paymento to operate checkout and payment monitoring without possessing independent signing authority. ### What Paymento cannot do Paymento cannot independently: * Sign a wallet transaction * Transfer merchant funds * Settle funds without merchant authorization * Issue a wallet-based refund without merchant authorization * Add itself as a merchant signing credential * Replace the merchant’s signing authority * Recover a lost merchant authenticator using a Paymento-held recovery credential ### What Turnkey can and cannot do Turnkey provides the secure infrastructure that protects key material and evaluates wallet policies. Turnkey does not independently decide to move merchant funds. A transaction signature is produced only when the configured authentication and authorization requirements are satisfied. Turnkey’s role as the wallet infrastructure provider does not give Paymento independent control of the merchant’s wallet. ### How authorization works When a merchant settles funds or sends a supported wallet-based refund: 1. Paymento prepares the transaction request. 2. The merchant reviews the relevant transaction details. 3. Paymento performs any required account-level verification. 4. The merchant authorizes the wallet action using the registered passkey. 5. The authorized transaction is signed and submitted to the relevant blockchain. 6. Paymento tracks the transaction and displays its status. A merchant authorization may support multiple related transactions within one settlement operation. It does not give Paymento permanent or unrestricted authority over the wallet. ### Settlement destinations Settlement funds can be sent only to an eligible destination configured for the store. Before approving settlement, merchants should verify: * The destination address * The blockchain network * The asset being settled * The amount * The expected network cost Blockchain transactions are generally irreversible. Paymento cannot reverse a correctly signed transaction sent to an incorrect merchant-configured address. See Settlement for the merchant settlement process. ### Can Paymento freeze funds? Paymento cannot seize or independently transfer merchant-controlled on-chain funds. However, custody of funds and access to Paymento’s software are different matters. Paymento may restrict access to its dashboard, checkout, monitoring, API, or settlement interface in accordance with its Terms of Service, security policies, legal obligations, or account restrictions. Restricting access to Paymento’s services does not transfer ownership of the underlying on-chain assets to Paymento. ### What this model protects against The Embedded Wallet authorization model is designed to prevent Paymento, its employees, or a party possessing only Paymento’s ordinary service credentials from independently signing wallet transactions. It does not protect against every possible risk. Merchants remain responsible for: * Protecting the registered passkey and its provider account * Securing devices used to authorize wallet actions * Reviewing transaction details before approval * Protecting the configured settlement wallet * Maintaining available backup and recovery methods * Responding promptly if an authenticator or device may be compromised Merchant authorization should never be approved without reviewing the destination and transaction details. ### Reporting a concern If you believe a wallet action occurred without your authorization, or you identify behavior that contradicts this page: 1. Do not approve any additional wallet requests. 2. Preserve relevant transaction hashes, timestamps, and screenshots. 3. Contact [Paymento Support](https://paymento.io/contact-us/) immediately. 4. For security vulnerabilities, follow Paymento’s published vulnerability-disclosure process.