Skip to main content

​
Overview

Managed wallets are Prudra-hosted, hierarchical (HD) wallets per organisation. A single master seed is encrypted with Google Cloud KMS. From that seed, the API derives one master wallet per chain (standard BIP44-style paths) and any number of child addresses for inbound segregation — without exposing mnemonics or private keys to your servers. Agents and backends call authenticated HTTP routes (or the @prudra/wallet SDK). Signing happens inside the API for short intervals using decrypted key material that is zeroed immediately after use.

​
How it works

  1. Organisation master seed — On first provision, Prudra generates a mnemonic, encrypts it with KMS, and stores one OrganisationMasterSeed row. Subsequent masters for other chains re-use the same seed with a different account index.
  2. Master wallet — POST /wallet-infra/master-wallets creates on-chain address m/44'/60'/{accountIndex}'/0/0 for the requested chain, tracks supportedTokens, and registers the address for monitoring where Alchemy is configured.
  3. Child addresses — POST /wallet-infra/master-wallets/:id/child-addresses increments an internal childIndex, derives m/44'/60'/{accountIndex}'/0/{childIndex}, stores a ChildAddress, and optionally registers monitoring.
  4. Signing — withWalletSigner loads the seed from KMS, derives the private key for the master or child path, runs your signing callback, then wipes buffers.

​
Quickstart

HTTP 
curl -X POST https://api.prudra.dev/wallet-infra/master-wallets \
  -H "Authorization: Bearer prv_live_..." \
  -H "Content-Type: application/json" \
  -d '{"chain":"base","name":"Treasury","supportedTokens":["USDC","USDT"]}'
SDK (initialise from @prudra/core first): 
import { provisionManagedWallet, deriveManagedChildAddress, Chain, Token } from '@prudra/wallet';

const master = await provisionManagedWallet({
  chain: Chain.BASE,
  name: 'Agent treasury',
  supportedTokens: [Token.USDC, Token.USDT],
});

const child = await deriveManagedChildAddress({
  masterWalletId: master.id,
  name: 'Checkout lane A',
});

​
Configuration

ConcernDetail
ChainsMust be in the supported chains list; validated on provision.
KMSGOOGLE_KMS_KEY_RESOURCE_NAME (or stub behaviour when PAYMENT_STUB_MODE=true without full KMS).
LimitsHobby/plan limits apply to managed wallet count and active chains; child addresses are not capped by childAddresses plan field in normal operation.
MonitoringAlchemy registration is best-effort; failures are logged and do not roll back provision.

​
SDK reference

Export (@prudra/wallet)Purpose
provisionManagedWalletCreate master on a chain.
listManagedWallets / getManagedMasterWalletRead masters.
deriveManagedChildAddress / listManagedChildAddressesChildren.
getManagedWalletBalances / getManagedWalletTransactionsPortfolio + history.
Each wraps GET/POST under /wallet-infra/master-wallets.

​
API reference

MethodPathDescription
POST/wallet-infra/master-walletsProvision master (body: chain, name, supportedTokens, optional network).
GET/wallet-infra/master-walletsList masters for the organisation.
GET/wallet-infra/master-wallets/:idSingle master.
POST/wallet-infra/master-wallets/:id/child-addressesDerive child (name, optional metadata).
GET/wallet-infra/master-wallets/:id/child-addressesList children.
GET/wallet-infra/master-wallets/:id/balancesCached Alchemy-derived balances.
GET/wallet-infra/master-wallets/:id/transactionsPaginated WalletTransaction rows.
All routes require authentication. POST /master-wallets uses billing enforce(createManagedWallet) and enforce(activateChain).