Skip to main content
For enhanced security, we strongly recommend using a dedicated secondary wallet for API operations. Important: Your secondary wallet does not need any funds - the private key is only used for cryptographic signing, not for transactions. Rise handles all gas fees and transaction costs.
No funds in the wallet does not mean low stakes. The private key is signing authority over your Rise account, so whoever holds it can authenticate as you and pay or withdraw from any team the wallet’s role can reach. That’s the whole reason to isolate it. Keep it in a secret manager or HSM, never in code or version control, and if it ever leaks, revoke the wallet under Security → Authorized Wallets before anything else, which strips its on-chain role. A leaked key keeps working until you revoke it, unlike a JWT that expires in 24 hours.

​
Why Use a Secondary Wallet?

Using a dedicated secondary wallet for API operations provides several critical security benefits:

Security Isolation

  • Keeps your primary wallet secure
  • Limits potential exposure
  • Reduces risk of fund loss
  • Isolates API activities

Risk Management

  • Minimal funds at risk
  • Easy to monitor activity
  • Quick to replace if compromised
  • Clear audit trail

Operational Control

  • Dedicated for API operations
  • Separate from personal transactions
  • Easy to manage permissions
  • Simplified monitoring

Compliance

  • Clear separation of concerns
  • Easier compliance reporting
  • Simplified audit trails
  • Better regulatory compliance

​
Setting Up a Secondary Wallet

1

Create New Wallet

Generate a new wallet specifically for API operations
2

Secure Storage

Store the private key securely (password manager, HSM)
3

Test Integration

Test with staging environment first
4

Monitor Activity

Set up alerts and regular monitoring

​
Setting Up Your Secondary Wallet

Once you have created a wallet using any of the methods described in Understanding Private Keys, you can set it up as a secondary wallet for API operations:
1

Create New Account

Create a new account in your existing wallet and name it “API Operations”
2

Export Private Key

Export the private key following your wallet’s specific process
3

Secure Storage

Store the private key in a password manager or HSM
4

No Funds Required

No funds needed - Rise handles all gas fees
Refer to Understanding Private Keys for detailed wallet creation and private key extraction steps for MetaMask, Coinbase Wallet, and other wallet types.

​
Authorize the wallet on your RiseID

Creating the wallet isn’t enough on its own. Until you authorize it on your RiseID, the SIWE handshake rejects it with a 403, because the wallet holds no role on your account yet. Add it under Security → Authorized Wallets in the app and wait for the on-chain grant to confirm. The full steps are in Getting API Access.

​
Recovery Procedures

​
If Wallet is Compromised

1

Immediate Actions

Stop all API operations immediately
2

Assess Damage

Review recent transactions
3

Create New Wallet

Generate replacement wallet
4

Update Configuration

Update environment variables
5

Resume Operations

Test with new wallet