OpenWallet.sh: Self-Sovereign Wallets for AI Agents

Can OWS and Stripe Link coexist?
Yes. The same agent can have an OWS wallet for on-chain operations and a Link wallet for off-chain purchases. Many teams run this dual-stack.

OpenWallet.sh (OWS) is the open-source, self-sovereign alternative to hosted agent wallets. Where Stripe’s Link wallet holds your keys for you, OWS puts your keys in ~/.ows/wallets/, AES-256-GCM encrypted, and gives every tool on your machine a single, unified way to sign for any chain. This post walks through the architecture, the spec, the install, and the practical tradeoffs.

The problem OWS is solving

Every agent, every CLI, every dev tool implements its own key management. Foundry stores its keystores in ~/.foundry/keystores/. Hardhat puts your private key in .env as a PRIVATE_KEY=0xab3f... line. Solana’s CLI uses ~/.config/solana/id.json. Your agent has its own .env.local with SIGNER=0x91c.... Your bot has ./config/wallet.json. And your shell history has export PRIVATE_KEY=0x....

That’s 6 formats in 6 locations, 0 of them encrypted. Lose any one of them and the agent’s funds are gone. Get any one of them phished and the attacker has full control. The whole system is a security nightmare, and it’s what every AI-agent developer runs into on day one.

OWS is the standard that consolidates all of this into a single, encrypted, multi-chain vault with one CLI.

The architecture: one vault, one interface, AES-256-GCM

OWS replaces the 6 silos with one vault at ~/.ows/wallets/. Every wallet in the vault is a JSON document encrypted with a single master key (derived from your passphrase via Argon2id). Every chain derives its addresses from the same BIP-39 seed. Every tool — Foundry, Hardhat, your agent, your bot — talks to the same OWS daemon over a Unix socket or a local HTTP endpoint.

The data model is simple:

~/.ows/
├── config.json          # Which wallet is active, daemon settings
├── wallets/
│   ├── agent-treasury.json   # AES-256-GCM encrypted
│   └── personal-cold.json
└── audit.log            # Every sign request, with timestamp + tool name

The wallet JSON itself is a standard schema — versioned, documented, and signed by OWS. You can back it up, version-control it (encrypted), migrate between machines, or restore from a 24-word seed phrase. The standard is on GitHub at openwallet-sh/ows.

Multi-chain in one command

Creating a new wallet is the showcase feature:

$ ows wallet create --name agent-treasury
✓ Created wallet agent-treasury

Chain        Address                                       Path
eip155:1     0xab16...7e3f                                  m/44'/60'/0'/0/0
solana:5eykt4U 7Kz9...Bm4x                                 m/44'/501'/0'/0'
bip122:000...e93 bc1q...8k4m                              m/84'/0'/0'/0/0
cosmos:cosmo... cosmos1...j4kp                            m/44'/118'/0'/0/0
tron:mainnet  TKLm...9xP2                                  m/44'/195'/0'/0/0
ton:mainnet   EQCx...Wd3k                                  m/44'/607'/0'/0'

One command creates a wallet that has working addresses for EVM, Solana, Bitcoin, Cosmos, Tron, and TON. All from one seed. The same wallet signs for all of them. The same passphrase decrypts all of them.

This is the killer feature. With Foundry, you create a keystore. With Hardhat, you create a new .env. With Solana CLI, a different format. With your agent, yet another. With OWS, one wallet covers the entire agent’s reach.

Agent integration: programmatic signing with a policy layer

The OWS daemon exposes a local HTTP API (default: http://127.0.0.1:8421) that any tool can hit to request a signature. The daemon checks the configured policy before signing:

// In your agent
const ows = require('@ows/client');

const signature = await ows.sign({
  wallet: 'agent-treasury',
  chain: 'eip155:1',
  to: '0xHotelHotels.eth',
  value: '0.3e',          // 0.3 ETH
  data: '0x',             // plain transfer
  policy: {
    max_value_per_tx: '0.5e',
    max_value_per_day: '5e',
    allowlist: ['0xHotelHotels.eth', '0xUber.eth', '0xAmazon.eth'],
  },
});

The daemon checks value <= 0.5 ETH and destination is in the allowlist and daily spend hasn’t exceeded 5 ETH. If all three pass, the signature is produced locally with the wallet’s private key. The key never leaves the daemon. The agent gets a signed transaction it can broadcast to the chain.

If a rule fails, the daemon returns a policy_violation error and the agent’s request is denied. The audit log records every check (passed or failed).

Six design principles

OWS is built on six design principles (per the OWS v1.0.0 spec):

1. Local-first. Keys never leave the device unless the user explicitly exports them. No cloud sync, no remote backup, no SaaS dependency.
2. One standard. One schema, one interface, one CLI. Tools don’t reinvent key management; they call OWS.
3. Strong encryption by default. AES-256-GCM at rest, Argon2id for key derivation, no plaintext fallback. If a tool can’t decrypt the wallet, it can’t use it.
4. Multi-chain from day one. One seed, one wallet, every chain you care about. No per-chain setup.
5. Policy over review. OWS believes in programmatic policy (allowlist, caps, rate limits) over human review. Review is fallback, not primary.
6. Auditable by default. Every sign request, every policy check, every approval, every denial — logged to audit.log. The user can grep their own history.

OWS vs. a hosted agent wallet

The tradeoff is the same as always: self-sovereignty vs. UX. With Stripe’s Link wallet, you tap “Approve” on your phone. With OWS, you write a policy file. The hosted approach is friendlier; the self-sovereign approach is more flexible and doesn’t require trusting a third party with your money.

For personal-assistant agents paying at Amazon, the hosted model is the right answer. For treasury agents moving money on-chain across multiple chains, OWS is the right answer. Most production agent stacks in 2026 are running both.

Getting started

OWS ships as a single static binary. Install in 30 seconds:

# macOS
brew install openwallet-sh/tap/ows

# Linux
curl -sSf https://openwallet.sh/install.sh | sh

# From source
git clone https://github.com/openwallet-sh/ows
cd ows && make install

Then:

$ ows init
✓ Created ~/.ows/ — choose a strong passphrase
$ ows wallet create --name agent-treasury
✓ Created wallet agent-treasury
$ ows daemon start
✓ Listening on http://127.0.0.1:8421

FAQ

Is OWS a wallet or a standard?
Both. The OWS specification is the standard — the on-disk format, the JSON schema, the policy DSL, the signing rules. The reference implementation is the ows CLI. You can implement OWS in any language; the standard is the contract.

What chains are supported?
EVM (Ethereum, Base, Arbitrum, Optimism, Polygon, BNB), Solana, Bitcoin, Cosmos (Cosmos Hub, Osmosis, Celestia, Injective, Sei), Tron, TON. Adding a new chain is a 200-line spec change.

What if I lose my passphrase?
Your 24-word seed phrase is the backup. OWS shows it once at wallet creation. Write it down. Without the seed, the funds are unrecoverable — that’s the price of self-sovereignty.

Can OWS and Stripe Link coexist?
Yes. The same agent can have an OWS wallet for on-chain operations and a Link wallet for off-chain purchases. Many teams run this dual-stack.

Is there hardware-key support?
OWS v1.1 (in development) adds YubiKey and Touch ID signing. The v1.0 daemon is software-only.