[ INTENTS ]
Your agent acts. Never holds credentials.
Transaction Intents sign and broadcast on-chain in a TEE — private keys never leave hardware. Execution Intents call HTTP APIs, databases, and GraphQL through credential-bound bindings — secrets are injected server-side and never reach your agent.
Before and after Intents
The difference between hoping credentials are safe and knowing they never reached the agent.
- Private key hardcoded in env or passed to agent at runtime
- Key extractable via prompt injection, logs, or memory dump
- No guardrails — agent can drain the wallet in one transaction
// ❌ Agent holds the private key
const wallet = new Wallet(
process.env.PRIVATE_KEY
);
const tx = await wallet.sendTransaction({
to: "0xDEF1...",
value: parseEther("1.0")
});
- Agent submits an intent — signing happens inside the TEE
- Private key never exported — stays in HSM/TEE memory
- Per-agent guardrails enforce allowlists, caps, and chain restrictions
// ✓ Agent submits intent — never sees the key
const tx = await client.agents.submitTransaction(agentId, {
to: "0xDEF1...",
value: "1.0",
chain: "base",
simulate_first: true
});
✓ Simulated via Tenderly. Signed in TEE. Broadcast.
✓ Private key never left hardware.
[ GUARDRAILS ]
Guardrails you configure, not hope for
Every constraint is enforced server-side before the key is ever touched.
Per-agent address allowlists
Restrict each agent to specific contract addresses. Transactions to unlisted addresses are rejected before signing — even if the agent is compromised.
Value caps (per tx & per day)
Set a max value per transaction and a rolling 24-hour daily limit — in native units (ETH, BTC, SOL, etc.). Enforced per chain family, atomically, before signing.
Chain restrictions + Tenderly simulation
Limit agents to specific chains. Optionally simulate every transaction via Tenderly before broadcast — reverts are caught before they hit the chain.
Token allowlist
Control which tokens your agents can transfer. Restrict to specific contract addresses or lock agents to the platform's verified token registry — preventing transfers of unknown or malicious tokens.
Per-chain guardrails
Set different value caps, daily limits, overhead budgets, and address allowlists for each blockchain. Includes daily transaction count caps, ATA creation restrictions (Solana), and per-chain non-value cost budgets for rent, fees, and energy.
XRP transaction type restrictions
Restrict which XRPL transaction types an agent can submit — Payment, TrustSet, OfferCreate, NFTokenMint, and 30+ more. Deny-by-default for sensitive operations like AccountDelete.
[ EXECUTION ]
Execution Intents — APIs without exfiltrating keys
The same Intents model for off-chain work: agents describe what to call, 1Claw holds the credentials and enforces guardrails before the request leaves our infrastructure.
HTTP & GraphQL bindings
Humans configure named bindings (Stripe, GitHub GraphQL, internal APIs). Agents call execute with a binding name — credentials are injected server-side.
Credentials never exposed
API keys and tokens live in the __agent-keys vault. Binding responses report credential_set, not the secret. Rotate credentials without recreating bindings.
Host & path guardrails
Per-binding allowed_hosts and allowed_paths (wildcard). Agent execution_guardrails add binding-type limits, timeouts, and per-minute rate caps.
Live credential references from vault secrets
Point a binding at an existing vault secret instead of copying the credential. The server resolves the live value at execution time — rotate the secret once, every binding updates automatically.
Vault or TEE execution
Default runs in Vault with SSRF protection and sanitized audit logs. Pro+ can enforce TEE-only mode per agent — direct Vault calls are rejected, all secrets are blocked, and requests must route through the hardware enclave.
const { data } = await client.bindings.execute(agentId, {
binding: "stripe-api",
intent_type: "http",
params: { method: "GET", path: "/v1/customers?limit=10" },
});
// Stripe secret never in agent memory — injected server-sidePro+ for HTTP/GraphQL · Team+ for databases and gRPC · Full Execution Intents docs
[ MULTI-CHAIN ]
HSM-backed keys for 6 blockchains
Provision per-agent signing keys with a single API call. Private keys are generated and stored in the HSM — only public keys and derived addresses are returned. Built on official chain SDKs (rust-bitcoin, solana-sdk, xrpl-rust) for production-grade signing across every chain.
EIP-191 personal_sign
Sign human-readable messages for identity verification, login challenges, and off-chain attestations.
EIP-712 typed data
Sign structured typed data for gasless approvals (ERC-20 Permit), meta-transactions, and DeFi operations. Deny-by-default with domain allowlists.
All EIP-2718 tx types
Legacy (type 0), EIP-2930 access lists (type 1), EIP-1559 (type 2), EIP-4844 blobs (type 3), and EIP-7702 (type 4).
Sign-only mode
Sign transactions without broadcasting. Get the signed tx hex and broadcast via your own RPC — same guardrails enforced.
Gasless (ERC-4337)
Smart account mode wraps transactions as UserOperations with sponsored gas via Pimlico paymaster. Agent pays no gas.
Raw digest signing
Sign client-computed 32-byte digests for ERC-1271/ERC-7739 flows (e.g. Polymarket CLOB). Gated behind per-agent raw_signing_enabled flag, audit-logged.
0+ supported EVM chains
EIP-155, EIP-1559, EIP-2930, EIP-4844, and EIP-7702 signing. Server-side nonce management with idempotency keys. Tenderly simulation on all networks. Native signing + broadcast for Bitcoin (rust-bitcoin, all address types), Solana (solana-sdk, SPL tokens), XRP (xrpl-rust, 30+ transaction types), Cardano, and Tron. Sign-only mode available on all chains.
Ethereum
ETH
Base
ETH
Arbitrum One
ETH
Optimism
ETH
Polygon
MATIC
BNB Chain
BNB
Avalanche
AVAX
Linea
ETH
Scroll
ETH
zkSync
ETH
Blast
ETH
Mantle
MNT
Gnosis
xDAI
Celo
CELO
Moonbeam
GLMR
Sonic
S
Berachain
BERA
Unichain
ETH
World Chain
ETH
Taiko
ETH
Fraxtal
frxETH
Lisk
ETH
Ronin
RON
Metis
METIS
BOB
ETH
Ink
ETH
Soneium
ETH
Immutable
IMX
Flare
FLR
Story
IP
Plus testnets: Sepolia, Base Sepolia, Holesky (EVM), Bitcoin Signet (tb1q… addresses), Solana Devnet, XRP Testnet, Cardano Preprod (addr_test1… addresses), Tron Shasta, and more. Provision with testnet chain names (e.g. "bitcoin-signet", "cardano-preprod") to get network-correct addresses. All non-EVM testnets include faucet links in the docs. Any EVM chain supported by Tenderly can be added. See full list →
[ X402 ]
Autonomous agent billing
Your agent can pay for its own compute
With x402, agents submit payment intents just like transaction intents. 1claw signs the USDC settlement on Base via the Coinbase CDP facilitator. The agent never holds or controls funds.
- Agent submits payment intent — no USDC in agent memory
- Settlement signed in TEE, broadcast on Base (EIP-155:8453)
- Per-request micropayments — no subscriptions needed for agents
- Replay protection via SHA-256 proof hashing
// Agent pays for API access via x402
const response = await fetch("https://api.1claw.xyz/v1/...", {
headers: {
"X-PAYMENT": paymentProof
}
});
// ✓ Payment signed in TEE, settled on Base
// ✓ Agent never held USDCEnterprise-grade signing infrastructure
Built for production DeFi teams
Execution Intents (HTTP/GraphQL) start at Pro. On-chain transaction signing is available on Business and Enterprise. Custom pricing for high-volume DeFi teams with dedicated TEE nodes and SLA guarantees.
Already using 1claw Vault? Enable Intents on your agents →