> For the complete documentation index, see [llms.txt](https://hinkal-team.gitbook.io/hinkal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hinkal-team.gitbook.io/hinkal/hinkal-waas/description/key-management.md).

# Key Management

This page describes key management for **WaaS managed wallets**. The [Hinkal API](/hinkal/hinkal-api/description/overview.md) follows the same generate-encrypt-use-inside pattern for the user's **Hinkal shielded key**: it is generated inside the enclave, stored encrypted outside it, and decrypted only inside the enclave when a request needs it.

When a user creates a WaaS wallet, three separate private keys are generated inside the secure enclave — one each for EVM, Solana, and Tron. Keys are generated fresh for each wallet and never derived from a shared seed.

Immediately after generation, each private key is encrypted using the enclave's own private key and the ciphertext is stored in the database. The raw key material never leaves the enclave. Because decryption requires the enclave's private key — which itself never leaves the enclave environment — no external system, including the API server or the database, can access raw key material.

When a transaction needs to be signed, the API forwards the request to the enclave. The enclave decrypts the relevant private key internally, produces the signature, and returns only the signature to the API. The private key remains inside the enclave throughout this process and is not included in the response.

This means:

* Raw private keys are never stored in plaintext anywhere
* Raw private keys are never transmitted over the network
* Signing happens entirely within the enclave boundary
* The API server and database only ever handle encrypted key material and signatures