The co-signer

The co-signer holds the second key. It never runs in the browser, so the key is never exposed. On each spend request it validates the request against the account’s on-chain policy and the poisoning firewall, then returns a signature or a veto. Fail-closed: if the firewall’s data source is unreachable, it withholds the signature.

Server endpoint

Expose two routes on the same origin as your app:

GET /api/cosign returns the co-signer’s public address, which the browser locks into each new account.
POST /api/cosign authorizes a spend and returns a signature or a veto.

// server-only — the key stays here
import { cosign, cosignerAddress } from '@ctrl-arcz/demo-kit/cosign';

const COSIGNER_PK = process.env.COSIGNER_PK; // never a VITE_/public var

// GET
res.json({ address: cosignerAddress(COSIGNER_PK) });

// POST
const result = await cosign({ privateKey: COSIGNER_PK, body: req.body });
res.json(result); // { approved: true, signature } | { approved: false, reason, riskReasons }

cosign reconstructs the request, runs a LocalCoSigner backed by the SDK poisoning check(), and signs the exact struct hash the contract will verify.

The policy the co-signer enforces

Even though the contract re-checks these, the co-signer refuses to put its name on a request that violates them:

Target lock

The spend target must equal the account’s on-chain lockedTarget. A script that swaps the destination cannot get a signature.

Amount and window

The amount must be within the remaining cumulative cap, and the account must not have expired.

Risk firewall

Runs check(owner, target). Vetoes on a block verdict (drainer, lookalike, zero-value bait, or unavailable data). Set vetoOn: 'warning' to also stop new/fresh recipients.

In-process co-signer (tests and local)

For tests or a single-process setup, use LocalCoSigner directly with a pluggable risk source:

import { LocalCoSigner } from '@ctrl-arcz/sdk';

const machine = new LocalCoSigner(COSIGNER_PK, {
  riskCheck: async (owner, target) => ({ level: 'safe', complete: true }),
  vetoOn: 'block',
});

const auth = await machine.authorize(request); // { approved, signature } | { approved: false, reason }

The co-signer is a trust point. If it is unreachable, funds are never stranded: after expiry anyone can sweepExpired the account home to the vault with the owner’s key alone. Design your key management around that escape hatch.

Get started

Integrate the SDK

Concepts

Reference

Server endpoint

The policy the co-signer enforces

In-process co-signer (tests and local)

​Server endpoint

​The policy the co-signer enforces

​In-process co-signer (tests and local)

Server endpoint

The policy the co-signer enforces

In-process co-signer (tests and local)