> For the complete documentation index, see [llms.txt](https://docs.paymento.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.paymento.io/embedded-wallet/overview.md).

# Overview

A Paymento Embedded Wallet is a crypto wallet created for your store, where **you** hold the only key that can move money out, and Paymento handles everything that does not require that key.

You do not download a wallet app, write down a recovery phrase, or fund an address before you can take your first payment. You register a passkey, the same biometric or security-key credential your device already uses and the wallet exists.

### Built on Turnkey

Paymento uses [Turnkey](https://www.turnkey.com/), an embedded-wallet infrastructure provider, for key generation, storage and signing.

Your key is generated and used inside **hardware-isolated AWS Nitro Enclaves**. This is not a\
multi-party scheme with a key share held by Paymento! Paymento holds no fragment of your key, and the raw private key is never exposed to Paymento, to Turnkey's application servers, or to employees of either company.

Turnkey enforces the rule that matters: a policy attached to your wallet **denies** Paymento's\
credential the ability to sign. That rule is not a promise in Paymento's code, it is enforced by\
the party holding the key.

The result is that **Paymento can neither move nor freeze your funds.** Your assets stay on-chain in your own wallet, not in a Paymento custodial account. See [Custody and Signing Authority.](/embedded-wallet/custody-and-signing-authority.md)

### What Paymento does, and does not do

| Action                                     | Who does it | Requires your passkey   |
| ------------------------------------------ | ----------- | ----------------------- |
| Create the wallet                          | Paymento    | No                      |
| Derive a receiving address for a payment   | Paymento    | No                      |
| Watch the chain and credit the payment     | Paymento    | No                      |
| Show balances and settlement history       | Paymento    | No                      |
| Prepare a settlement transaction           | Paymento    | No                      |
| **Sign and broadcast a transfer**          | **You**     | **Yes**                 |
| **Refund a payer from the wallet**         | **You**     | **Yes**                 |
| Add a new signing credential to the wallet | —           | Paymento is denied this |

Address derivation deliberately does not need your passkey. If it did, your checkout would stop working every time you closed your laptop.

### Getting started

1. In the merchant panel, create a store and choose the embedded wallet.
2. Register a passkey when prompted. **This is the wallet.** 
3. Select the assets you want to accept. Paymento derives your store's wallet address for each.
4. Set a **settlement destination** per asset, the address you want funds consolidated to. You cannot settle without one.
5. Integrate as normal. The API, checkout and plugins behave identically to a Bring Your Own Wallet store.

### How your customers pay

On **Ethereum and ERC-20, Solana and SPL, and the Bitcoin family**, your customer gets a plain deposit address and QR code. They pay from any wallet or exchange, with nothing to connect. This is the main practical advantage of the embedded wallet over Bring Your Own Wallet, where those chains require a connected wallet.

On **Tron and TRC-20  (including USDT-TRC20) your customer must connect a wallet** (TronLink or WalletConnect). The embedded wallet does not get the deposit-address flow for Tron.

This is structural, not a setting. On Tron, all payments to an embedded wallet arrive at a single address, because Tron settlement can only transfer out of that one account. With one shared address, a payment cannot be matched to an order by where it landed, so it has to be identified by transaction hash which requires the payer's wallet to report it. There is no flag to enable, and it will not change while Tron settlement works this way.

If deposit-address simplicity matters for your stablecoin flow, use USDT on Ethereum or Solana.

### When money arrives

Each payment is received at its own address under your store wallet (except on Tron, where all payments arrive at one address). Funds stay there until you settle.

There is no automatic sweep. Nothing moves until you approve it with your passkey. That is a deliberate consequence of the custody model: an automatic sweep would require a key that could sign without you, and no such key exists.

Balances across your store's addresses are shown in the panel, read live from the chain.