> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crossmint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signer Decision Tree

> A step-by-step guide to picking the right operational and recovery signers for your wallet architecture.

<Warning>
  **You are viewing docs for the previous version of the Wallets SDK.** We recommend upgrading to V1.
  See the [updated version of this page](/wallets/concepts/custody-models) or the [V1 migration guide](/wallets/guides/migrate-to-v1).
</Warning>

Use this decision tree to identify the right signer configuration for your use case. If you are not yet familiar with the different signer types, start with [Wallet Signers](/wallets/v0/concepts/wallet-signers) first.

## Step 1: Who is the wallet for?

| Controller | Go to |
| - | - |
| End users (consumers, retail) | Step 2a (below) |
| Your company (treasury, operations, disbursements) | Step 2b (below) |
| AI agents | Step 2c (below) |

## Step 2a: User wallets — does the user need self-custody?

| Answer | Operational signer | Recovery signer | Configuration |
| - | - | - | - |
| Yes — user must be sole custodian | [Device key](/wallets/v0/concepts/wallet-signers#device-key) or [Passkey](/wallets/v0/concepts/wallet-signers#passkey) | [Email OTP](/wallets/v0/concepts/wallet-signers#email-otp) + optional [SMS OTP](/wallets/v0/concepts/wallet-signers#sms-otp) | [Non-custodial user wallet](/wallets/v0/concepts/common-signer-configurations#non-custodial-user-wallets) |
| No — your company manages wallets on behalf of users | [Cloud KMS](/wallets/v0/concepts/wallet-signers#cloud-kms) or [Server signer](/wallets/v0/concepts/wallet-signers#server-signer) | [Cloud KMS (recovery)](/wallets/v0/concepts/wallet-signers#cloud-kms-recovery) | [Custodial user wallet](/wallets/v0/concepts/common-signer-configurations#custodial-user-wallets) |
| Hybrid — user custody with limited company access | User: [Device key](/wallets/v0/concepts/wallet-signers#device-key) / [Passkey](/wallets/v0/concepts/wallet-signers#passkey) + Company: [Server signer](/wallets/v0/concepts/wallet-signers#server-signer) (scoped) | [Email OTP](/wallets/v0/concepts/wallet-signers#email-otp) | [Scoped custody](/wallets/v0/concepts/common-signer-configurations#scoped-custody) |

<Accordion title="Choosing between device key and passkey">
  | Criterion | Device key | Passkey |
  | - | - | - |
  | Silent signing (no user prompt per tx) | ✓ (default) | ✗ (always requires biometric) |
  | Cross-device sync | ✗ (single device) | ✓ (via iCloud, Google, 1Password) |
  | Best for | High-frequency actions, invisible UX | Explicit user confirmation, multi-device |
</Accordion>

## Step 2b: Company wallets — what level of key security do you need?

| Scenario | Operational signer | Recovery signer | Configuration |
| - | - | - | - |
| Production treasury or high-value operations | [Cloud KMS](/wallets/v0/concepts/wallet-signers#cloud-kms) | [Cloud KMS (recovery)](/wallets/v0/concepts/wallet-signers#cloud-kms-recovery) in a separate account/region | [Treasury wallet](/wallets/v0/concepts/common-signer-configurations#treasury-wallets) |
| Development, staging, or low-risk operations | [Server signer](/wallets/v0/concepts/wallet-signers#server-signer) | [Cloud KMS (recovery)](/wallets/v0/concepts/wallet-signers#cloud-kms-recovery) or [Externally custodied key](/wallets/v0/concepts/wallet-signers#externally-custodied-key) | [Treasury wallet](/wallets/v0/concepts/common-signer-configurations#treasury-wallets) |

## Step 2c: Agent wallets — who hosts the agent?

| Host | Operational signer | Recovery signer | Configuration |
| - | - | - | - |
| User-hosted (self-managed infrastructure) | [Server signer](/wallets/v0/concepts/wallet-signers#server-signer) or [Cloud KMS](/wallets/v0/concepts/wallet-signers#cloud-kms) | [Externally custodied key](/wallets/v0/concepts/wallet-signers#externally-custodied-key) | [User-hosted agent](/wallets/v0/concepts/common-signer-configurations#user-hosted-agents) |
| Platform-hosted (you run agents on behalf of users) | User: [Passkey](/wallets/v0/concepts/wallet-signers#passkey) + Agent: [Server signer](/wallets/v0/concepts/wallet-signers#server-signer) (scoped) | [Email OTP](/wallets/v0/concepts/wallet-signers#email-otp) | [Platform-hosted agent](/wallets/v0/concepts/common-signer-configurations#platform-hosted-agents) |

## Step 3: Do you need account recovery?

Almost always **yes**. The only exception is server-side wallets where you control all key material and have your own backup procedures.

| Wallet type | Minimum recommended recovery | Enhanced recovery |
| - | - | - |
| User wallets | [Email OTP](/wallets/v0/concepts/wallet-signers#email-otp) | Email OTP + [SMS OTP](/wallets/v0/concepts/wallet-signers#sms-otp) + [Managed support center](/wallets/v0/concepts/wallet-signers#managed-support-center) |
| Company wallets | [Cloud KMS (recovery)](/wallets/v0/concepts/wallet-signers#cloud-kms-recovery) | Cloud KMS + [Externally custodied key](/wallets/v0/concepts/wallet-signers#externally-custodied-key) |
| Agent wallets | [Email OTP](/wallets/v0/concepts/wallet-signers#email-otp) or [Externally custodied key](/wallets/v0/concepts/wallet-signers#externally-custodied-key) | Depends on hosting model |

<Note>
  For enterprise clients, the Crossmint team is happy to provide architectural guidance and review your setup before you go to production. <a href="https://www.crossmint.com/contact/sales" target="_blank">Get in touch</a> to schedule a session with the solutions team.
</Note>

## Next Steps

<CardGroup cols={2}>
  <Card title="Registering a Signer" icon="plus" href="/wallets/v0/guides/signers/registering-a-signer">
    Learn how to add operational signers to a wallet.
  </Card>

  <Card title="Common Signer Configurations" icon="sitemap" href="/wallets/v0/concepts/common-signer-configurations">
    Blueprints for common configurations we see amongst our clients.
  </Card>
</CardGroup>