Account and security
Accounts and app wallets
Section titled “Accounts and app wallets”Users sign in to multiple apps with one Pouchi account. Each app has a separate wallet by default. Signing in with the same account can therefore give a user different wallet addresses and balances in different apps.
Wallet sharing requires an explicit choice by the app operator. A shared login alone does not give an app access to another app’s wallet.
Pouchi Home shows the account’s wallets, connected apps, devices and recovery settings.
Key storage
Section titled “Key storage”The user’s key shares are handled inside an iframe or embedded frame on the Pouchi vault origin. Key material stays within that boundary. App code never accesses it. The app asks the SDK to sign in or request a transaction approval and receives the result.
An app login is separate from wallet signing authority. Transactions require user authentication, such as a passkey or PIN, on the Pouchi approval screen. Agent execution is limited to the targets, amounts, number of calls and duration the user approves. See Payment permissions and limits for developer settings.
Account recovery
Section titled “Account recovery”Users set up recovery once for the Pouchi account, rather than separately for each wallet. Recovery uses a passkey or recovery code. On a new device, users follow the recovery steps in the Pouchi screen.
The server does not automatically recover the account for the user. Email sign-in alone does not complete recovery. Users need to keep the recovery method they set up.
Gas fees
Section titled “Gas fees”The app pays transaction gas fees. Gas is never charged to the user’s wallet. App operators configure sponsorship budgets and per-operation limits and check that they can support the requested execution.
Experience wallets
Section titled “Experience wallets”Maroo Experience and Dongbaek ONE use disposable experience wallets. They end after inactivity or when the user wraps up, and remaining test funds are returned. Ticketly introduces a continuing Pouchi account and its app wallet. See the Pouchi tour.
Personal data and current scope
Section titled “Personal data and current scope”Personal data does not go on chain. Apps must keep email addresses, names and other personal information out of transaction data.
The examples in these docs use test assets on Maroo Testnet (chainId 450815). WaaSWallet 5.0 has not had an external security audit.