# Introduction

Kryard is a remote key-signing and wallet-infrastructure service. Applications
create wallets and private keys, define signing policies, and request signatures
**without ever handling private key material directly** — and can sponsor users'
transactions through a managed **EIP-7702** relay.

## Two surfaces, one signing core

1. **[Turnkey-compatible signing API](/signing/)** — a wire-compatible drop-in for
   Turnkey's secp256k1 EVM signing, backed by real AWS KMS envelope encryption and
   an isolated signer. Multi-curve (secp256k1 / ed25519 / P-256), 38 address
   formats, and HPKE key export. Cutover is a single `TURNKEY_BASE_URL` swap.
2. **Managed EIP-7702 relay** — Kryard signs, fronts gas, and broadcasts type-4
   transactions for a user who signs only a 7702 authorization + batch digest.
   Consumed through [`@kryard/sdk`](https://www.npmjs.com/package/@kryard/sdk).

::: tip Live on Sepolia
The signing core, the managed relay (EIP-1559 + 7702), gas metering, the prepaid
gas tank, and the ERC-20-gas path are all proven live on Sepolia today.
:::

## Invariants

These hold for every request and shape the API:

- **The API never decrypts wallet keys.** Only the isolated signer holds IAM
  permission to call KMS decrypt; the KMS encryption context is verified on every
  decrypt.
- **Every sensitive operation is an immutable `activity`** — the unit of work,
  idempotency (`SHA-256(canonical_json(body))` per organization), and audit.
- **Signing is bound to activity + policy.** The signer re-verifies the payload
  matches the policy-evaluated input before signing, and refuses on mismatch.

## Authentication

Every request is authenticated with an **`X-Stamp`** header — an API-key signature
over the canonical request payload. The SDK's built-in `createApiKeyStamper`
produces it for you; see the [Quickstart](/relay/quickstart).