How It Works#

The API gateway is a stateless proxy — it authenticates the API key and forwards requests to the TEE. Everything security-critical (keys, signing, policy checks) happens exclusively inside the Trusted Execution Environment.

1. Register — one API call creates a wallet and returns an API key. The TEE derives the private key from the MPC master secret and returns the public key. No blockchain transaction needed.
2. Operate — the agent uses the API key to transfer NEAR, swap tokens, call smart contracts, or withdraw cross-chain. The TEE checks the policy, signs the transaction, and broadcasts it to the NEAR network.
3. Control — the wallet owner configures policies for the agent via the dashboard: spending limits, address whitelists, transaction confirmations, multisig, or instant freeze.

Agent ID#

Every wallet is identified by its Agent ID — a public key derived deterministically inside the TEE from the MPC master secret. The agent receives an API key for authentication, while the Agent ID serves as the on-chain identity.

The agent uses the API Key to authenticate all requests. The private key behind the Agent ID never leaves the TEE — transactions are signed inside the secure enclave and the agent never has access to it.

Multi-Chain Support#

A single wallet provides addresses on multiple blockchains. All cross-chain transfers go through the NEAR Intents protocol — no bridges, no gas tokens needed on the destination chain.

Policy Engine#

The wallet owner controls the agent's permissions through a policy — a set of rules that are encrypted and stored on-chain. The policy is decrypted and evaluated inside the TEE on every transaction. The agent cannot bypass or modify it.

Policies are stored encrypted on-chain (on the NEAR blockchain). Only the TEE can decrypt and evaluate them. This means neither the API gateway operator nor the agent can see or tamper with the raw policy rules.

Example Policy

{
  "rules": {
    "limits": {
      "per_transaction": { "native": "10000000000000000000000000" },
      "daily": { "*": "100000000000000000000000000" },
      "hourly": { "*": "50000000000000000000000000" }
    },
    "transaction_types": ["withdraw", "call", "transfer", "swap", "intents_deposit"],
    "addresses": {
      "mode": "whitelist",
      "list": ["bob.near", "dex.near"]
    },
    "rate_limit": { "max_per_hour": 60 },
    "time_restrictions": {
      "timezone": "UTC",
      "allowed_hours": [9, 17],
      "allowed_days": [1, 2, 3, 4, 5]
    }
  },
  "approval": {
    "threshold": { "required": 2, "of": 3 },
    "above_usd": 1000,
    "approvers": [
      { "id": "ed25519:pubkey1", "role": "admin" },
      { "id": "ed25519:pubkey2", "role": "signer" },
      { "id": "ed25519:pubkey3", "role": "signer" }
    ]
  }
}

Multisig Approval#

When a transaction exceeds the approval threshold (e.g. above $1,000), it goes into a pending state. Designated approvers sign the request using their NEAR wallet (NEP-413 signature). Once the required number of signatures is collected, the transaction executes automatically.

Agent: POST /wallet/v1/withdraw { amount: "$5,000" }
  -> Response: { status: "pending_approval", required: 2, approved: 0 }

Approver 1: Signs approval via NEAR wallet (dashboard)
  -> { approved: 1, required: 2 }

Approver 2: Signs approval via NEAR wallet (dashboard)
  -> Threshold met -> auto-execute -> { status: "success", tx_hash: "..." }

Quick Start#

1. Register a wallet

curl -s -X POST https://api.outlayer.fastnear.com/register

# Response:
# {
#   "api_key": "wk_15807dbda492...",
#   "near_account_id": "36842e2f73d0...",
#   "handoff_url": "https://outlayer.fastnear.com/wallet?key=wk_..."
# }

The api_key is shown only once. Store it securely.

2. Get addresses

# NEAR address
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.outlayer.fastnear.com/wallet/v1/address?chain=near"

# Ethereum address
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.outlayer.fastnear.com/wallet/v1/address?chain=ethereum"

3. Check balance

# Native NEAR balance
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.outlayer.fastnear.com/wallet/v1/balance?chain=near"

# FT token balance (e.g. USDT)
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.outlayer.fastnear.com/wallet/v1/balance?chain=near&token=usdt.tether-token.near"

4. Transfer NEAR

curl -s -X POST -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"receiver_id":"bob.near","amount":"1000000000000000000000000"}' \
  "https://api.outlayer.fastnear.com/wallet/v1/transfer"

5. Swap tokens

# Swap wNEAR -> USDT (handles deposit, storage, and settlement automatically)
curl -s -X POST -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"token_in":"nep141:wrap.near","token_out":"nep141:usdt.tether-token.near","amount_in":"1000000000000000000000000"}' \
  "https://api.outlayer.fastnear.com/wallet/v1/swap"

6. Call a NEAR contract

curl -s -X POST -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"receiver_id":"wrap.near","method_name":"near_deposit","args":{},"deposit":"10000000000000000000000"}' \
  "https://api.outlayer.fastnear.com/wallet/v1/call"

7. Withdraw (gasless cross-chain via Intents)

# Tokens must be in Intents balance first (use /intents/deposit or /swap)
curl -s -X POST -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"to":"receiver.near","amount":"1000000","token":"usdt.tether-token.near","chain":"near"}' \
  "https://api.outlayer.fastnear.com/wallet/v1/withdraw"

8. Configure policy (optional)

Share the handoff URL with the wallet owner so they can set spending limits, whitelists, and multisig rules from the dashboard:

https://outlayer.fastnear.com/wallet?key=wk_...

API Reference#

All endpoints except /register require the Authorization: Bearer <api_key> header.

Base URL: https://api.outlayer.fastnear.com

Security Model#

AI Agent Skill File#

For AI agents that support skill files (Claude MCP, OpenAI functions, etc.), OutLayer provides a ready-to-use skill definition that teaches the agent how to register, fund, and operate the wallet.

# Fetch the skill file
curl -s https://outlayer.fastnear.com/SKILL.md

The skill file contains step-by-step instructions, API reference, error handling, and guidelines for the AI agent. Point your agent framework to this URL and the agent will know how to set up and use its wallet automatically.

Comparison with Traditional Custody#

Dashboard#

The wallet owner manages everything through the OutLayer dashboard. The agent only sees the API.