Fordefi's WaaS is a one-stop solution for companies to build secure and easy-to-use non-custodial wallets for their end users. Typical use cases include:

Crypto retail platforms can use Fordefi WaaS to add a non-custodial multi-chain Web3/DeFi wallet into their existing custodial app.
Fintechs and payment companies can use Fordefi WaaS to create non-custodial crypto payment wallets.
DApps can use Fordefi WaaS to create embedded wallets to simplify user onboarding and create a seamless transaction experience.

There are two main pillars in the Fordefi WaaS product:

Key Management: By leveraging multi-party computation (MPC) technology, Fordefi's WaaS safeguards the security and privacy of users' funds. Fordefi's implementation empowers end users to retain control over their private keys and simplifies the backup and recovery process. Notably, Fordefi's WaaS eliminates the need for users to remember lengthy seed phrases. Instead, they can create a secure backup on their personal Google Drive or iCloud. Learn more.
Blockchain connectivity: Fordefi provides the full suite of APIs needed to integrate with multiple blockchains, including a fully managed transaction lifecycle, transaction simulation, automatic detection of incoming transactions, portfolio data of the users' token holdings (including NFT data), and much more. Fordefi provides a unified interface across the different chains we support (Bitcoin, EVM, Solana, Cosmos, Sui, Aptos, and others), which allows our customers to easily scale their product across chains.

These tools grant developers the flexibility to design custom product flows that seamlessly align with their application's existing design and user interface.

High-Level Architecture

In WaaS, an End User represents the user of the customer. Fordefi customers can create non-custodial MPC wallets for their end users, where for each such wallet, the end user has a unique key-share, and Fordefi holds the matching key-share, so ensuring segregation of keys between users. Importantly, only the end user, and not the customer, has access to the end user's key share, which is essential to maintain the non-custodial nature of the wallet.

Fordefi's WaaS solution consists of three main subcomponents:

The Fordefi REST API consists of a set of endpoints for managing end users, vaults, assets, and transactions. When integrating Fordefi WaaS, you will be calling those endpoints from the backend of your application. Learn More.
The Fordefi SDK mostly consists of functions related to key management: key generation, signing, backup, and recovery. When integrating Fordefi WaaS, you will be using this SDK on the client-side, as part of your mobile or web application. We provide SDKs for mobile (React Native, Android, iOS) and for Web.
The Fordefi Web Console provides your administrators and operators with a set of dashboards that present the details of your organization's end users, as well as their transactions, vaults, and assets. Learn more.

Fordefi API or Fordefi SDK?

As a rule of thumb, the bulk of the work, and specifically the "orchestration" of any flow (key generation, transaction signing, and so forth) is done backend-to-backend through the Fordefi REST API. The exception are operations that require explicit access to the user's MPC share. To preserve the non-custodial nature of the end-user wallet, the MPC share never leaves the end-user's device. Therefore, operations that require using that key share – things like key generation, signing, backup, and recovery – must be done directly on the end-user device, with the help of the Fordefi MPC SDK.

For example, a transaction flow involves your backend first calling the Create Transaction REST API with all the details of the transaction (for example, the originating wallet, the recipient, and the data of the transaction). The API then returns a transaction ID, which your backend can then use to monitor the status of the transactions (for example, was it signed? Did is revert on chain?), retrieve data about the transaction (for example, how much gas fee did it incur, what were its effects?) or control the transaction (for example, cancel it). All those operations can and should be done backend-to-backend using REST API calls. The only exception is that to sign transaction, you will need to pass this transaction ID to your client-side application, which should then use the signTransaction function in the Fordefi SDK to sign the transaction. This function triggers the MPC protocol between the end-user device and the Fordefi Secure Enclave and results in a signed transaction, which our server then automatically sends to the blockchain.