> ## Documentation Index
> Fetch the complete documentation index at: https://docs.riseworks.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Secondary Wallets for API Operations

> Learn how to use dedicated secondary wallets for secure API operations with Rise B2B API

<Note>
  For enhanced security, we strongly recommend using a dedicated secondary wallet for API operations. **Important**: Your secondary wallet does not need any funds - the private key is only used for cryptographic signing, not for transactions. Rise handles all gas fees and transaction costs.
</Note>

<Warning>
  **No funds in the wallet does not mean low stakes.** The private key is signing authority over your Rise account, so whoever holds it can authenticate as you and pay or withdraw from any team the wallet's role can reach. That's the whole reason to isolate it. Keep it in a secret manager or HSM, never in code or version control, and if it ever leaks, revoke the wallet under **Security → Authorized Wallets** before anything else, which strips its on-chain role. A leaked key keeps working until you revoke it, unlike a JWT that expires in 24 hours.
</Warning>

## Why Use a Secondary Wallet?

Using a dedicated secondary wallet for API operations provides several critical security benefits:

<CardGroup cols={2}>
  <Card title="Security Isolation" icon="shield">
    * Keeps your primary wallet secure
    * Limits potential exposure
    * Reduces risk of fund loss
    * Isolates API activities
  </Card>

  <Card title="Risk Management" icon="triangle-exclamation">
    * Minimal funds at risk
    * Easy to monitor activity
    * Quick to replace if compromised
    * Clear audit trail
  </Card>

  <Card title="Operational Control" icon="gear">
    * Dedicated for API operations
    * Separate from personal transactions
    * Easy to manage permissions
    * Simplified monitoring
  </Card>

  <Card title="Compliance" icon="file-lines">
    * Clear separation of concerns
    * Easier compliance reporting
    * Simplified audit trails
    * Better regulatory compliance
  </Card>
</CardGroup>

## Setting Up a Secondary Wallet

<Steps>
  <Step title="Create New Wallet">
    Generate a new wallet specifically for API operations
  </Step>

  <Step title="Secure Storage">
    Store the private key securely (password manager, HSM)
  </Step>

  <Step title="Test Integration">
    Test with staging environment first
  </Step>

  <Step title="Monitor Activity">
    Set up alerts and regular monitoring
  </Step>
</Steps>

## Setting Up Your Secondary Wallet

Once you have created a wallet using any of the methods described in [Understanding Private Keys](/authentication/private-keys), you can set it up as a secondary wallet for API operations:

<Steps>
  <Step title="Create New Account">
    Create a new account in your existing wallet and name it "API Operations"
  </Step>

  <Step title="Export Private Key">
    Export the private key following your wallet's specific process
  </Step>

  <Step title="Secure Storage">
    Store the private key in a password manager or HSM
  </Step>

  <Step title="No Funds Required">
    No funds needed - Rise handles all gas fees
  </Step>
</Steps>

<Note>
  **Refer to [Understanding Private Keys](/authentication/private-keys) for detailed wallet creation and private key extraction steps for MetaMask, Coinbase Wallet, and other wallet types.**
</Note>

## Authorize the wallet on your RiseID

Creating the wallet isn't enough on its own. Until you authorize it on your RiseID, the SIWE handshake rejects it with a `403`, because the wallet holds no role on your account yet. Add it under **Security → Authorized Wallets** in the app and wait for the on-chain grant to confirm. The full steps are in [Getting API Access](/authentication/api-access#authorize-your-api-wallet).

## Recovery Procedures

### If Wallet is Compromised

<Steps>
  <Step title="Immediate Actions">
    Stop all API operations immediately
  </Step>

  <Step title="Assess Damage">
    Review recent transactions
  </Step>

  <Step title="Create New Wallet">
    Generate replacement wallet
  </Step>

  <Step title="Update Configuration">
    Update environment variables
  </Step>

  <Step title="Resume Operations">
    Test with new wallet
  </Step>
</Steps>