Treasury wallets and smart accounts

Treasury wallets are native HSM-backed wallets for human users across six chains. Keys are generated server-side, stored in a per-org __treasury-keys vault, and never leave the enclave unless you export them.

• Six chains: Ethereum, Bitcoin, Solana, XRP, Cardano, Tron
• Custody is XOR 2-of-2 on Pro and Team, Shamir 2-of-3 on Business and Enterprise
• Safe multisig proposals collect signatures and auto-execute at threshold
• Agent delegation modes: Owner (agent EOA is a Safe signer) or Delegated (agent signs with the treasury key via Intents API)

1. 1

   Use a human API key. Free tier gets a 403 here. Replace with your 1ck_ key from Settings → API Keys.

   bash Copy

   export TOKEN=1ck_your_key_here

2. 2

   Generate treasury wallets. Omit chains to create all six.

   bash Copy

   curl -X POST "https://api.1claw.co/v1/treasury/wallets/generate" \
     -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
     -d '{ "chains": ["ethereum", "solana"] }'

3. 3

   Create a treasury bound to a Safe address so you can manage signers and proposals. Use the address of an existing deployed Safe multisig.

   bash Copy

   curl -X POST "https://api.1claw.co/v1/treasury" \
     -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
     -d '{ "name": "Ops Treasury", "safe_address": "0xYourSafe" }'

4. 4

   Export the treasury ID from the creation response.

   bash Copy

   export TREASURY_ID="paste-treasury-id-from-response"

5. 5

   Create a multisig proposal against that treasury. Build the Safe transaction off-chain using the Safe SDK (@safe-global/protocol-kit) or the Safe Transaction Service API. Compute the EIP-712 safe_tx_hash and read the current Safe nonce from the Safe service.

   bash Copy

   curl -X POST "https://api.1claw.co/v1/treasury/$TREASURY_ID/proposals" \
     -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
     -d '{
       "to": "0xRecipient",
       "value_wei": "1000000000000000000",
       "data": "0x",
       "operation": 0,
       "safe_tx_hash": "0x...",
       "nonce": 5
     }'

6. 6

   Export the proposal ID from the creation response.

   bash Copy

   export PID="paste-proposal-id-from-response"

7. 7

   Sign the proposal. When approve signatures reach the Safe threshold, the proposal auto-executes and broadcasts. signer_address must be a Safe owner. signature is the EIP-712 approval signature for the safe_tx_hash, produced by that owner's key.

   bash Copy

   curl -X POST "https://api.1claw.co/v1/treasury/$TREASURY_ID/proposals/$PID/sign" \
     -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
     -d '{ "signature": "0x...", "signer_address": "0xYou", "decision": "approve" }'

8. 8

   Poll GET /v1/treasury/$TREASURY_ID/proposals/$PID until status is 'executed'.

   bash Copy

   curl "https://api.1claw.co/v1/treasury/$TREASURY_ID/proposals/$PID" \
     -H "Authorization: Bearer $TOKEN"

You now have a treasury wallet and a Safe proposal that collects signatures and executes on its own once threshold is met.

Where this goes wrong in practice. Treasury operations are low-frequency and high-consequence, which is the worst combination for building operational muscle.

• Export is used as an integration path. The endpoint exists for migration, requires password re-auth and is audit-logged, and the moment a key is exported for convenience it becomes a copy you cannot revoke.
• Recovery is never rehearsed. Wallet generation is easy and the first real test of your recovery procedure should not be an incident.
• Non-EVM chains are assumed to behave like EVM. Bitcoin needs a fee rate, XRP needs a destination tag, Cardano needs a TTL. A missing chain-specific field is a failed or misdirected send, not a validation error you catch in review.
• Gasless sends hide a dependency. Sponsorship requires a configured paymaster, so a working flow can stop working because of a third-party key nobody on the team remembers.