Non-custodial accounts

A non-custodial account is a Digital Asset Account that the end customer controls. The assets sit in the end customer’s own onchain wallet, and every debit needs the end customer’s approval from a key on their own device. Neither Circle nor your backend can move funds from the account without that approval. To create one, see Create a non-custodial account.

​

What’s different from a custodial account

A non-custodial account is a Digital Asset Account with a custodyType of self. Your integration differs from a custodial account in these ways:

• The end customer approves every debit: transfers, withdrawals, and account creation carry the end customer’s signature in the X-Device-Authorization header. Your API key still authenticates every request, but it can’t approve a debit on its own.
• Requests come from your application: the React Native SDK builds and signs each request in your application, and your backend relays it to Circle with your API key.
• The end customer signs in and registers a key: you onboard the end customer first, as for a custodial account. The end customer then signs in with social login and registers an authorization key on their device.
• The end customer creates the account: the end customer signs the create request. Circle doesn’t create a non-custodial account when KYB is approved.
• One wallet on one blockchain: the account holds USDC and EURC in one onchain wallet on its home blockchain.

For a side-by-side comparison, see Account structure.

​

How a debit is approved

Every transfer or withdrawal from a non-custodial account carries a fresh signature from the end customer’s authorization key. The signature covers the exact request, so a request that’s changed after the end customer approves it fails.

1. Your application asks the end customer to approve the request. Their device unlocks the authorization key with biometrics, or the screen lock on an iPhone, and the key signs the exact request.
2. Your backend relays the signed request to Circle without changing it, and adds your API key.
3. Circle’s system passes the request to the Circle TEE enclave. The enclave checks the end customer’s signature and produces a wallet signature for that request only.
4. Circle submits the transaction to the blockchain.

The enclave runs in a trusted execution environment (TEE): a hardware-isolated environment that runs only approved code, which Circle verifies before the enclave can use any key material. Circle’s system carries the request to the enclave but can’t change it. Your API key, Circle’s system, and social login can’t produce a valid request on their own.

​

The authorization key

The authorization key is the key that approves every debit. It has these properties:

• Held by the end customer: the private key is created on the end customer’s device and never leaves it.
• Hardware-backed: the device’s secure key hardware stores the key, and the key can’t be exported.
• Approved per use: the device asks the end customer to confirm before each signature. On an Android-powered device, the end customer must use a strong biometric, such as a fingerprint or face unlock. A PIN, pattern, or password doesn’t work. On an iPhone, Face ID, Touch ID, or the screen lock works.

An end customer can register a key on more than one device. Each device signs in with social login and adds its own key. The following devices are supported: Simulators, emulators, and devices without secure key hardware can’t create an authorization key.

​

Who does what

Your backend must onboard the end customer before they sign in. Login links the end customer to an existing clientEntityId. It never creates one. See Onboard customers.

​

Home blockchain and balance

Each non-custodial account has one onchain wallet on one home blockchain. You choose it with the blockchain field when you create the account, which defaults to ARC, and you can’t change it later. Not every blockchain is available in every environment, and an unavailable one returns 400. See Create an account. The account balance shows the home wallet only.

​

Network fees

The end customer doesn’t need native tokens to pay network fees for non-custodial account transactions.

​

Limitations in the sandbox preview