Embedded Starknet Wallet

A device-native, self-custodial embedded wallet for Starknet. The signing key is created and used on the user's device — Cavos cannot see it, cannot sign with it, and cannot move funds. Available via @cavos/kit for web and @cavos/kit/react-native for mobile (Expo Development Builds, EAS, or bare React Native — Expo Go is not supported).

In the browser, the device key is a non-extractable P-256 key stored via WebCrypto. On React Native, it uses the OS keystore. These platform primitives provide the hardware-backed isolation — the SDK does not enforce non-extractability on Node or other server runtimes.

Account model

Cavos provisions a Cairo DeviceAccount — a smart contract account with on-chain secp256r1 (P-256) verification. The device key signs transactions, and the contract validates the signature before execution.

The DeviceAccount contract implements __validate__ to recover the secp256r1 signer from the transaction signature.
Execution routes through the Cavos paymaster (SNIP-9 execute_from_outside) — users pay no gas.
Passkey: On Starknet, the passkey is an on-chain approver that authorizes adding new devices — it never signs transactions. Passkey approval works on both Sepolia and mainnet.

Install

npm install @cavos/kit

Connect and execute

Use Cavos.connect with chains: ["starknet"]. Connect never deploys the account — it's created lazily on first execute. You can call execute when status is "undeployed" or "ready". Only "needs-device-approval" blocks execution.

import { Cavos } from "@cavos/kit";

const session = await Cavos.connect({
  chains: ["starknet"],
  defaultChain: "starknet",
  network: "mainnet",
  identity: { userId: user.id, email: user.email },
  appSalt: "my-app",
  appId: process.env.NEXT_PUBLIC_CAVOS_APP_ID,
  paymasterApiKey: process.env.NEXT_PUBLIC_CAVOS_PAYMASTER_API_KEY,
});

const wallet = session.wallet("starknet");

// Execute when undeployed OR ready
if (wallet.status !== "needs-device-approval") {
  const { transactionHash } = await wallet.execute([
    {
      contractAddress: TOKEN_ADDRESS,
      entrypoint: "transfer",
      calldata: [recipient, amountLow, amountHigh],
    },
  ]);
}

What you get

Self-custodial

Cavos never holds a key that can move user funds. The on-chain account is the sole authority over signers.

Cairo smart account

DeviceAccount contract with native secp256r1 signature validation in __validate__.

Gasless execution

The Cavos paymaster sponsors deployment and every transaction — users never need ETH or STRK.

Arbitrary multicalls

Execute any contract calls: token transfers, DeFi interactions, NFT mints — all in one transaction.

Passkey approval

Passkeys authorize adding new devices on-chain. They never sign transactions — device approval only.

Lazy deploy

Connect derives the address immediately. The account is deployed on first execute, atomically.

Start building on Starknet.

Follow the quickstart to reach a sponsored transaction.

Starknet guide Create an account