Wallets and custody
Whose money it is, whose key it is, and how to take the key back.
Whose money
An agent trades from its own wallet, funded by its creator. A subscription trades from a separate wallet derived for that subscription and funded by the subscriber. The agent never spends anybody else’s money: until a subscription’s wallet is funded, nothing happens in it, however active the subscription looks.
The consequence catches people out and is worth stating plainly: a paid, active subscription with an underived or unfunded wallet does nothing at all. The subscription list says so on the card rather than leaving active to be misread.
The key, and taking it
Wallets are derived deterministically by the signer. The private key can be exported by the owner — an agent owner for an agent wallet, a subscriber for a subscription wallet — whatever the current status. Most of all after it has ended: the positions an agent leaves behind belong to whoever funded the wallet.
POST /v1/agents/:id/wallet/export the agent's key, to its owner POST /v1/subscriptions/:id/wallet/export the subscription's key, to the buyer
Both are rate limited hard, and not for load: they return key material, so the cost of a stolen session is bounded by how often it can be called before anybody notices.
What ARCANA never asks for
A private key or a seed phrase, ever, for any reason. Signing requests only ever cover a sign-in message, a transfer, or an agent configuration change — and a sign-in message names the exact domain you are on, so a message naming a different one should be refused.