Introduction

Kryard is a remote key-signing and wallet-infrastructure service. Applications create wallets and private keys, define signing policies, and request signatures without ever handling private key material directly — and can sponsor users' transactions through a managed EIP-7702 relay.

Two surfaces, one signing core

1. Turnkey-compatible signing API — a wire-compatible drop-in for Turnkey's secp256k1 EVM signing, backed by real AWS KMS envelope encryption and an isolated signer. Multi-curve (secp256k1 / ed25519 / P-256), 38 address formats, and HPKE key export. Cutover is a single TURNKEY_BASE_URL swap.
2. Managed EIP-7702 relay — Kryard signs, fronts gas, and broadcasts type-4 transactions for a user who signs only a 7702 authorization + batch digest. Consumed through @kryard/sdk.

Live on Sepolia

The signing core, the managed relay (EIP-1559 + 7702), gas metering, the prepaid gas tank, and the ERC-20-gas path are all proven live on Sepolia today.

Invariants

These hold for every request and shape the API:

• The API never decrypts wallet keys. Only the isolated signer holds IAM permission to call KMS decrypt; the KMS encryption context is verified on every decrypt.
• Every sensitive operation is an immutable activity — the unit of work, idempotency (SHA-256(canonical_json(body)) per organization), and audit.
• Signing is bound to activity + policy. The signer re-verifies the payload matches the policy-evaluated input before signing, and refuses on mismatch.

Authentication

Every request is authenticated with an X-Stamp header — an API-key signature over the canonical request payload. The SDK's built-in createApiKeyStamper produces it for you; see the Quickstart.