Wallet
A self-custodial bitcoin wallet inside Officer, with the keys held on your server rather than on a phone or in a browser.
What you get
- On-chain balance, receive addresses and transaction history
- Send, with fee control, coin selection and UTXO freezing
- Labels for addresses and transactions
- Multiple wallets, one active
- Chain data from Esplora or your own NBXplorer
How the keys are held
Read docs/wallet-key-custody.md in the platform for the full design. The short version:
- Your seed is encrypted under a key derived from your own passphrase (scrypt, N=2¹⁷), then encrypted again at rest. The server never stores the passphrase.
- The wallet is usable while locked — balances, history and fresh receive addresses all work without it. Unlocking is required only to sign.
- An unlock lasts 15 minutes by default and does not extend on use. A restart relocks everything.
- There is no "forgot passphrase". There is no recovery. Your seed backup is the recovery.
Multi-user
Each account gets its own wallet, sealed under its own passphrase. Granting the bitcoin-wallet permission
to a role gives those people a wallet of their own — it does not give them yours, and it does not give
you theirs. Not through the app, and not with root either: their seed is sealed under a passphrase you
do not have.
One caveat, stated plainly: balances and history are stored unencrypted so a locked wallet still shows them. Anyone with the database — or a backup of it — can see any user's balances. They can never move anything.
Permissions
One permission, bitcoin-wallet. Grantable per role like any other app permission.
Requirements
None to start. Esplora is used by default; point it at your own NBXplorer if you run one.