Agent-safe signing · Roundup

Privy alternatives for agent wallets on Solana

Privy is a strong default for consumer embedded wallets and now for agent wallets too. People look for alternatives when they need every policy enforced inside the trusted boundary, a human escalation path, a root they hold themselves, or simply a vendor that is not Stripe. Here are the options.

Last reviewed 2026-09-04 · Each row links to a full comparison with first-party sources

At a glance

	Who holds the root key	Policy	Cold root	Pricing
Coldstar	You; encrypted on your own drive	Limits, allowlists, daily cap, escalate to human	Yes	Free
Turnkey	Turnkey-operated enclaves	Rich Solana instruction rules; no daily caps	No	25 free signatures/mo, then $0.10
Crossmint	Owner: you. Agent key: Crossmint TEE	On-chain limits and rolling caps	Owner key could be	Free to 1,000 active wallets
Coinbase CDP Wallets	Coinbase Nitro enclaves	Per-transaction Solana rules	No	$0.005 per op; 5,000 free/mo
Openfort	Openfort TEE on Google Cloud	Solana rules incl. Anchor IDL checks	No	2,000 ops free, then $0.01
Para	2-of-2 MPC: device + Para HSM	Scopes, default deny; API layer	No	Free to 1,200 MAU
Magic	Magic Nitro enclaves	None documented	No	Free to 1,000 active wallets
Web3Auth	Reconstructed on the client at login	None documented	No	Free to 1,000 active wallets

Short cells; the linked pages carry the detail and the sources. Coldstar is beta software with an independent audit planned before its production release, and that is stated on every page.

The options

Coldstar

Self-hosted policy signer with an offline root; every rule evaluated on the signing machine. Beta.

How it works · Agent signing

Turnkey Hosted enclave signer

Enclave signer with the most expressive Solana policy grammar, evaluated in the enclave. Per-signature pricing.

Coldstar vs Turnkey →

Crossmint Smart-contract agent wallets

Smart wallets with a customer-held owner key and on-chain limits; agent key in Crossmint's TEE.

Coldstar vs Crossmint →

Coinbase CDP Wallets Hosted enclave signer + AgentKit

Nitro-enclave wallets, per-transaction Solana rules, open AgentKit framework, metered pricing.

Coldstar vs Coinbase CDP Wallets →

Openfort Hosted TEE signer

TEE wallets with Solana rules including instruction validation; self-hostable signer component.

Coldstar vs Openfort →

Para MPC embedded wallets

2-of-2 MPC with a user device share and scoped permissions, aimed at consumer apps.

Coldstar vs Para →

Magic Hosted TEE wallets

Mature embedded wallets in Nitro enclaves with JWT-bound signing. No policy engine.

Coldstar vs Magic →

Web3Auth MPC embedded wallets

Social-login MPC wallets that reconstruct the key on the client. No policy engine.

Coldstar vs Web3Auth →

How to choose

Consumer app, humans holding wallets? Privy, Para, Magic, or Web3Auth are all built for that; Privy and Para have policies, Magic and Web3Auth do not.
Headless agents spending your money? Turnkey, Coinbase CDP, Openfort, or Crossmint if you want a hosted policy; Coldstar if you want the root offline and the policy local.
Policy must be enforced inside the trusted boundary? Turnkey and Cubist claim in-enclave evaluation; Privy says some rules run at its API layer; Coldstar evaluates on the signing machine.

Frequently asked questions

Is Privy custodial?

Privy describes itself as non-custodial: the key is split with Shamir's Secret Sharing and only recombined inside its TEE, and it says it cannot sign alone. The key material lives on Privy-operated infrastructure.

Which Privy alternatives have a policy engine for Solana?

Turnkey, Coinbase CDP, Openfort, Crossmint, Para, and Coldstar. Magic and Web3Auth do not document transaction policies.

Which alternative keeps the root key out of the cloud entirely?

Coldstar. The root is an encrypted file on a drive you hold, used offline.

Try Coldstar in two minutes

Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.

pip install coldstar

Download All comparisons