# OpenSigner | Non-Custodial Wallet Key Management

Open-source, non-custodial, self-hostable private key management.

- [Introduction](/introduction/about): Learn how OpenSigner solves private key management by splitting keys into shares with Shamir's Secret Sharing for secure, non-custodial wallet recovery.
- [Users](/introduction/users): Understand how OpenSigner manages users, projects, and authentication providers across hot and cold storage for non-custodial key management operations.
- [Setup](/introduction/setup): Set up OpenSigner locally by cloning the repo, building Docker containers with Make, and configuring environment variables for all key management components.
- [Getting started](/introduction/getting-started): Get started with OpenSigner after setup. Launch the iFrame component in your browser, explore the Postman API collection, and begin managing wallet keys.
- [Import shares from Openfort](/introduction/import-share-from-openfort): Migrate user key shares from an Openfort project to a self-hosted OpenSigner instance. Export hot and cold shares, import them, and recover the key.
- [Security overview](/security/overview): Security overview of the OpenSigner trust model covering key share distribution, authentication providers, transport encryption, and TLS requirements.
- [Recovery methods](/security/recovery-methods): Compare OpenSigner recovery methods including password, passkey, and automatic recovery with OTP. Learn encryption details and non-custodial security guarantees.
- [Deployment scenarios](/security/deployment-scenarios): Explore six OpenSigner deployment scenarios from fully self-hosted to fully managed, with security trade-offs and custody implications for each configuration.
- [Threat analysis](/security/threat-analysis): Threat analysis of OpenSigner covering iframe compromise, auth service attacks, token forgery, and storage tampering with detailed mitigations and best practices.
- [System integrity](/security/system-integrity): Verify OpenSigner component integrity using Cosign attestation, Rekor transparency logs, and SHA-256 checksums for client-side iframe asset verification.
- [Create a key](/actions/signup): Step-by-step guide to creating keys in OpenSigner, including Shamir secret splitting across hot and cold storage with password, passkey, or automatic recovery.
- [Recover a key](/actions/login): Learn how OpenSigner recovers private keys on new devices using password, passkey, or automatic recovery with OTP through the iFrame and cold storage workflow.
- [Sign an operation](/actions/operation): Understand how OpenSigner handles transaction signing through ephemeral private key reconstruction inside the iFrame, ensuring keys never persist in memory.
- [Authentication component](/components/auth): Learn about the OpenSigner authentication component that verifies users and issues JWT access tokens for secure hot and cold storage key share retrieval.
- [iFrame component](/components/iframe): Deep dive into the OpenSigner iFrame, the browser-based component that handles private key generation, Shamir share splitting, and ephemeral reconstruction.
- [Hot storage component](/components/hot_storage): Technical guide to the OpenSigner hot storage component for storing frequently accessed key shares, with device linking, JWT auth, and Go implementation.
- [Shield component](/components/shield): Explore the OpenSigner Shield cold storage component built in Go with MySQL, supporting password, passkey, and automatic recovery with OTP for key shares.
- [OTP for automatic recovery](/components/cold_storage/otp): One-Time Password (OTP) verification for automatic recovery adds an additional layer of security when creating encrypted sessions.
- [Postman collection](/apis/postman): Test the OpenSigner components with the official Postman collection, with preconfigured requests for authentication, hot storage, and Shield cold storage.
- [Authentication service API](/apis/auth_service): Complete API reference for the OpenSigner Authentication Service with Swagger documentation for user identity validation, token issuance, and access control.
- [Hot storage API](/apis/hot_storage): Complete API reference for the OpenSigner Hot Storage with Swagger documentation covering device linking and storage of frequently accessed key shares.
- [Cold storage API](/apis/cold_storage): Complete API reference for the OpenSigner Cold Storage (Shield) with Swagger docs covering error codes for OTP, projects, shares, users, and authentication.
- [Non-Custodial Wallet Key Management](/index): OpenSigner is an open-source, self-hostable wallet key management system that issues non-custodial cryptographic keys using Shamir's Secret Sharing scheme.
- [API documentation theme warning](/apis/_components/ui-warning): Important notice regarding Swagger UI theme compatibility and recommended viewing settings.