robots.txt
# As a condition of accessing this website, you agree to abide by the following
# content signals:
# (a) If a content-signal = yes, you may collect content for the corresponding
# use.
# (b) If a content-signal = no, you may not collect content for the
# corresponding use.
# (c) If the website operator does not include a content signal for a
# corresponding use, the website operator neither grants nor restricts
# permission via content signal with respect to the corresponding use.
# The content signals and their meanings are:
# search: building a search index and providing search results (e.g., returning
# hyperlinks and short excerpts from your website's contents). Search does not
# include providing AI-generated search summaries.
# ai-input: inputting content into one or more AI models (e.g., retrieval
# augmented generation, grounding, or other real-time taking of content for
# generative AI search answers).
# ai-train: training or fine-tuning AI models.
# ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF
# RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT
# AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET.
llms.txt
# OpenSigner | Non-Custodial Wallet Key Management
Open-source, non-custodial, self-hostable private key management.
- [Introduction](/introduction/about): Learn how OpenSigner solves private key management by splitting keys into shares with Shamir's Secret Sharing for secure, non-custodial wallet recovery.
- [Users](/introduction/users): Understand how OpenSigner manages users, projects, and authentication providers across hot and cold storage for non-custodial key management operations.
- [Setup](/introduction/setup): Set up OpenSigner locally by cloning the repo, building Docker containers with Make, and configuring environment variables for all key management components.
- [Getting started](/introduction/getting-started): Get started with OpenSigner after setup. Launch the iFrame component in your browser, explore the Postman API collection, and begin managing wallet keys.
- [Import shares from Openfort](/introduction/import-share-from-openfort): Migrate user key shares from an Openfort project to a self-hosted OpenSigner instance. Export hot and cold shares, import them, and recover the key.
- [Security overview](/security/overview): Security overview of the OpenSigner trust model covering key share distribution, authentication providers, transport encryption, and TLS requirements.
- [Recovery methods](/security/recovery-methods): Compare OpenSigner recovery methods including password, passkey, and automatic recovery with OTP. Learn encryption details and non-custodial security guarantees.
- [Deployment scenarios](/security/deployment-scenarios): Explore six OpenSigner deployment scenarios from fully self-hosted to fully managed, with security trade-offs and custody implications for each configuration.
- [Threat analysis](/security/threat-analysis): Threat analysis of OpenSigner covering iframe compromise, auth service attacks, token forgery, and storage tampering with detailed mitigations and best practices.
- [System integrity](/security/system-integrity): Verify OpenSigner component integrity using Cosign attestation, Rekor transparency logs, and SHA-256 checksums for client-side iframe asset verification.
- [Create a key](/actions/signup): Step-by-step guide to creating keys in OpenSigner, including Shamir secret splitting across hot and cold storage with password, passkey, or automatic recovery.
- [Recover a key](/actions/login): Learn how OpenSigner recovers private keys on new devices using password, passkey, or automatic recovery with OTP through the iFrame and cold storage workflow.
- [Sign an operation](/actions/operation): Understand how OpenSigner handles transaction signing through ephemeral private key reconstruction inside the iFrame, ensuring keys never persist in memory.
- [Authentication component](/components/auth): Learn about the OpenSigner authentication component that verifies users and issues JWT access tokens for secure hot and cold storage key share retrieval.
- [iFrame component](/components/iframe): Deep dive into the OpenSigner iFrame, the browser-based component that handles private key generation, Shamir share splitting, and ephemeral reconstruction.
- [Hot storage component](/components/hot_storage): Technical guide to the OpenSigner hot storage component for storing frequently accessed key shares, with device linking, JWT auth, and Go implementation.
- [Shield component](/components/shield): Explore the OpenSigner Shield cold storage component built in Go with PostgreSQL, supporting password, passkey, and automatic recovery with OTP for key shares.
- [OTP for automatic recovery](/components/cold_storage/otp): One-Time Password (OTP) verification for automatic recovery adds an additional layer of security when creating encrypted sessions.
- [Postman collection](/apis/postman): Test the OpenSigner components with the official Postman collection, with preconfigured requests for authentication, hot storage, and Shield cold storage.
- [OpenSigner Auth Service API](/apis/auth_service): The authentication service is built on [Better Auth](https://www.better-auth.com/) and provides user registration, session management, JWT issuance, and origin validation. All `/api/auth/*` endpoints are handled by Better Auth. The service also exposes a JWKS endpoint, an origin-validation endpoint consumed by the iframe nginx proxy, and a health check. ## Reading the constraints in this document String bounds marked as *documented bounds* describe the range this API is designed to accept; they are not all enforced by server-side validation today. Treat them as the contract a client should keep to, not as a promise that a longer value is rejected. Responses carry only the properties listed here. Better Auth ignores a request field it does not declare instead of rejecting it.
- [Openfort Hot Storage API](/apis/hot_storage): Stores the "hot" key share for a signer's devices and accounts. ## Authentication Requests and responses carry only the properties listed here. A request body with a field the operation does not declare is rejected with 400. Every endpoint in this document requires a bearer token. The whole API mux is wrapped in `authMiddleware`, which rejects any request it cannot resolve to a user with 401 before the handler runs. There are no anonymous endpoints here; `/health` is served outside this API surface and is not documented below. The token is validated according to the `X-Auth-Provider` header. When that header is absent the default provider is used and the token is verified against the auth service's JWKS; other providers verify third-party tokens.
- [Openfort Cold Storage API](/apis/cold_storage): Shield by Openfort is a secure service dedicated to the protection of sensitive data. It ensures the confidentiality and security of data management by offering a robust framework for storing secrets and encryption parameters. Requests and responses carry only the properties listed here. Shield ignores a request field it does not declare instead of rejecting it.
- [Non-Custodial Wallet Key Management](/index): OpenSigner is an open-source, self-hostable wallet key management system that issues non-custodial cryptographic keys using Shamir's Secret Sharing scheme.
- [Authentication](/apis/auth_service/authentication): Sign up, sign in, and sign out with email and password.
- [Health](/apis/auth_service/health): Service health check.
- [JWKS](/apis/auth_service/jwks): JSON Web Key Set endpoints for token verification.
- [Origin Validation](/apis/auth_service/origin-validation): Origin validation for the iframe nginx proxy.
- [Session](/apis/auth_service/session): Session management and JWT token retrieval.
- [Encryption](/apis/cold_storage/encryption): Operations related to encryption and security
- [Projects](/apis/cold_storage/projects): Operations related to project management
- [Providers](/apis/cold_storage/providers): Operations related to authentication providers
- [Shares](/apis/cold_storage/shares): Operations related to managing user shares
- [Accounts](/apis/hot_storage/accounts): Accounts linking a user to a signer, plus share import and migration metadata.
- [Devices](/apis/hot_storage/devices): Register, recover, and inspect devices holding a key share.
