Frequently Asked Questions

General

What is WaaP?

WaaP (Wallet as a Protocol) is a wallet that doesn’t require seed phrases, and that you never hold a private key for. Signing happens in secure hardware on WaaP’s infrastructure, and your policy runs before every signature. In a WaaP Squid Mode account, the signature additionally requires Ika’s independent validator network, so no single party holds a key that can move your funds.

Is WaaP free?

WaaP is free for end users. For developers, integration is free, and free below 1,000 wallets. WaaP Squid Mode carries a per-signature network cost, which is being subsidised through launch.

What chains does WaaP support?

WaaP supports EVM chains (Ethereum, Optimism, Base, Arbitrum, Polygon, and more), Sui and Solana. Each chain is signed on natively: nothing is bridged and no asset moves between chains.

Security

Where is my key stored?

What you hold is not a key, and that is deliberate: a secret on your device is a secret that can be phished, lost or copied.

What your account holds instead is an object on Sui that it owns. Every signature request is checked against that object, so without it no signature is produced, by us or by anyone. It sits on a public chain rather than in our database, which means it is not something we can quietly change or revoke.

The signing itself is kept separate from that authority. For a standard account it happens in secure hardware on WaaP’s infrastructure. For a WaaP Squid Mode account it takes two parties, our enclave and Ika’s independent validator network, and neither can produce a signature without the other.

What if I lose my phone?

You can recover access using any login method you’ve set up (email, phone, Google, etc.). We recommend setting up multiple methods. Because nothing that can sign lives on your device, losing the device does not put your funds at risk.

Can WaaP move my funds?

Your policy runs before every signature, and anything outside your limits waits for your approval.

In a WaaP Squid Mode account, a signature also requires Ika’s validator network, so no single party, including us, holds a key that can move your funds.

Using WaaP

How do I back up my wallet?

You don’t need to. Your wallet is tied to your login credentials. As long as you can log in, you have access.

Can I use WaaP with hardware wallets?

WaaP is designed to provide hardware-wallet-level security without a physical device. Hardware wallet integration is not currently supported.

How do I export my keys?

Key export is available for users who need it. This generates a standard private key you can import elsewhere. Note: once exported, your security model changes to a traditional single-key setup.

WaaP for Agents

Can my WaaP wallet be used by AI agents?

Yes. WaaP provides a headless CLI (@human.tech/waap-cli) for AI agents and scripts. Agents sign up with email + password, get a standard wallet address, and can send transactions, sign messages, and query balances — all from the command line. Install with npm install -g @human.tech/waap-cli@latest.

Should I give my agent a Privilege, or its own wallet?

It depends on what you’re building.

• Privilege grant — Your agent uses your wallet with scoped, time-limited access. Best for personal agents acting on your behalf (e.g., a trading assistant that executes within your rules). You keep the wallet; the agent gets temporary permission to operate within bounds you set.
• Own wallet — Your agent gets its own WaaP account and address via the CLI. Best for autonomous services that need their own address and balance (e.g., a payment bot serving multiple users). Same signing model, same policy controls.

You can combine both: an agent with its own wallet can also receive Privileges from other users’ wallets.

How do I control what my agent can do?

WaaP has a layered security model for agents:

• Policies — Set daily spend limits and auto-approve rules for low-risk operations (waap-cli policy set --daily-spend-limit 500)
• 2FA — Enable two-factor authentication so high-risk transactions require your approval via Telegram, email, phone, or hardware wallet (waap-cli 2fa enable --telegram <chat_id>)
• Privileges — Scoped, time-limited tokens (max 2 hours) that let an agent bypass 2FA for pre-approved operations within defined constraints

New accounts start with 2FA disabled. If you want fully autonomous agent operation within policy limits, you don’t need to enable 2FA. For high-value operations, enable 2FA to stay in the loop.

What is a Privilege?

A Privilege is a scoped, time-bounded token that lets an agent or dApp bypass 2FA for specific operations. You define the constraints:

• Allowed addresses — which recipients the agent can send to
• Chain — which network the token is valid for
• Spend limit — maximum USD value across all transactions under this token
• Duration — how long the token lasts (max 2 hours, enforced server-side)

Once granted, transactions matching the scope are signed automatically. If 2FA is disabled on your account, Privileges are unnecessary — the agent can already transact freely within policy limits.

How do I approve or revoke my agent’s access?

• To approve: When 2FA is enabled and your agent attempts a transaction that exceeds policy limits, you’ll receive an approval request via your chosen 2FA method (Telegram, email, phone, or hardware wallet). Approve or deny from there.
• To revoke: Disable the agent’s session by changing the account password, or adjust policies with waap-cli policy set. Privileges expire automatically after their duration (max 2 hours).
• To shut down: Run waap-cli logout on the agent, or change the account password to invalidate all sessions.

What happens if my agent gets compromised?

A compromised agent cannot drain your funds on its own, because it holds nothing that can sign. On its machine sit the CLI and a session token. Every request it makes still has to clear your policy. On top of that:

• Transaction scanning catches malicious payloads before signing (powered by Blockaid)
• 2FA approval blocks unexpected transactions when enabled — you get a Telegram/email notification and deny it
• Privileges auto-expire after at most 2 hours, so a hijacked session has a hard time limit
• Policy limits cap how much damage is possible even if everything else fails

If you suspect a compromise: set your daily limit to 0 (requires approval for everything), let active Privileges expire, and change the account password to invalidate all sessions.

Can I run multiple agents on one WaaP wallet?

Yes. Each agent session is independent — you can run several agents against the same wallet, each with its own Privilege scope. To create separate agent accounts under one email, use the + notation (e.g., you+agent1@email.com, you+agent2@email.com). Each gets its own wallet address, policies, and session.

To revoke a single agent, change that account’s password or let its Privileges expire. Other agents are unaffected.

How is WaaP different from other agent wallets?

Four things, stated as what WaaP does rather than what anything else doesn’t:

• The agent never holds a key. It holds a session token and nothing that can sign, so the worst case is a request that still has to clear your policy.
• Policy is enforced before a signature exists. Your limits are not a report you read afterwards. Anything outside them waits for you.
• Scoped permissions are built in. Privileges define exactly what an agent can do, for how long, on which chain, and with whom.
• Human in the loop when it matters. Conversational approval via Telegram or email, one tap to approve or deny. You read a plain-language summary, not a cryptographic proof.

In a WaaP Squid Mode account, the signature also requires Ika’s independent validator network, so no single operator, including us, can produce one alone.

What frameworks and tools can I use with WaaP?

The WaaP CLI is framework-agnostic — any agent framework that can execute shell commands can use it (e.g., LangChain, CrewAI, AutoGPT, ElizaOS). Your agent calls waap-cli for wallet operations the same way it would call any other CLI tool.

Need more help?

Click the chat bubble in the bottom-right corner to talk to Iris, our AI support agent. It can answer most questions instantly or connect you with a team member. You can also reach us on Discord .