Phantom's Key Management System (KMS) stores wallet keys in secure enclaves instead of on your device. KMS powers features like your Cash account and Phantom Terminal trading account. You still control your keys and can export them, but day-to-day signing happens through KMS without exposing private keys to your device.

What is KMS? #

KMS allows you to securely generate, store, and access wallet keys inside trusted enclaves. Phantom does not export private keys out of the enclave environment, but you can choose to do so for the keys you control.

In Phantom, an account can be backed in two ways:

• KMS account: a reference to a KMS-managed wallet. Wallet keys are stored remotely in a secure enclave, not on your device.
• Local account: an account whose wallet keys are stored on your device.

Rather than storing the wallet's private keys on your device, KMS allows you to store the wallet's private key remotely in a secure enclave and a second cryptographic identifier key on your device that refers to the wallet's private key when you sign transactions. This is how KMS accounts support recovery and access across devices without exposing private keys.

Examples of Phantom features that use KMS accounts #

• KMS powers your Cash account.
• New wallets created with Google or Apple accounts use KMS.

How signing works #

Signing a transaction with a KMS account works differently than with a local account.

With a local account, Phantom signs transactions directly on your device. With a KMS account, your Phantom app or extension sends a signing request to KMS and receives a signature back. The flow works as follows:

1. Your Phantom app or extension sends a signing request to the KMS API.
2. KMS authenticates and authorizes the request in a Policy Engine enclave, where permissions and policies are enforced.
3. If allowed, signing happens in a Signer enclave.
4. KMS returns a signature to Phantom. The signed transaction is then submitted to the network.

Each request to KMS is cryptographically signed using an authenticator keypair that lives on your device. KMS checks that signature and independently enforces policies (like spending limits) before it will sign a transaction.

The authenticator #

KMS uses an authenticator to confirm that signing requests are coming from you. The authenticator is a cryptographic identifier key that’s separate from your wallet keys. The authenticator lets your Phantom app or browser extension request signatures from KMS without exposing your private keys.

This authenticator is stored in Phantom on your device.

How KMS accounts sync between mobile and extension #

Phantom stores a reference to a KMS-managed account and can re-discover it when you sign in on another device. The reference helps Phantom find the same KMS account again, and an authenticator on your device is used to access KMS and request signatures.

If you previously connected a third-party app to a KMS account, Phantom can recognize that same KMS account later when you sign in on another device.

Phantom can sync KMS accounts in two ways:

• Sync an existing KMS account. Phantom discovers a KMS account you already have and adds it to your account list.
• Create a new KMS account. When you create a new KMS account, a reference to it is saved so the account can appear on your other devices.

You can see various account types in your Phantom wallet—KMS, local recovery phrases, Ledger hardware wallets, or private keys.

See also #

Why you no longer need a PIN to sign in