Skip to content
SATSGATE

Approve treasury spends on your phone.

The phone signer is a web page that keeps your wallet’s policy key on your phone. Every refill of the agent’s allowance, and every purchase paid from the treasury, comes to the page for your approval. The page shows you the transaction, and the money moves only after you sign it there.

How you use itThe mechanism, in detail
The review screen on your phoneSample

Refill the allowance

Pays your allowance
100,000 sats
To the address
bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4
Spends from the treasury
250,000 sats
Fee
420 sats
Change back to the treasury
149,580 sats
Time left
1439 minutes
Approve and signReject

The screen also shows the transaction id.

Status
Pre-release. Tested only on regtest, a private test network with no real coins.
Devices
Passed on an Android 16 phone with Chrome and on an iPad with iPadOS 26.6.2 on 16 October 2026. An iPhone run is still owed.
Address
sign.satsgate.io, which is not live yet. The first release waits on the wallet repository going public and its hosting being set up.
Signs
Allowance refills and purchases paid from the treasury.

What the phone signer does

Your wallet keeps two balances. The agent spends a small allowance on its own, within the budgets you set. The treasury holds the rest, and every payment from it needs two signatures: one from the agent key and one from the policy key on your phone.

Two kinds of request
A refill moves an amount you choose from the treasury to the allowance. A treasury purchase pays a merchant straight from the treasury, when the allowance cannot cover a purchase the agent is making. The phone signs nothing else.
Your phone can be off
A request waits until you open the page, or until it expires. The agent keeps buying from its allowance in the meantime.
What the page checks for you
It reads every amount from the transaction itself. A refill can pay only your own allowance, and any change must come back to your treasury. If anything does not check out, the page refuses the request.
A web page, with no app store
Satsgate serves the page, so you are trusting the code it serves. Before it makes a key, the page tells you what a compromised version could do.

Allowance and treasury on the wallet page explains why the wallet keeps two balances.

Pairing your phone

You pair once. On the agent’s machine, run satsgate owner pair. It shows a QR code that opens the signer page on your phone.

  1. Step 1

    Open the page on your phone

    On an Android phone, scan the QR code and open the link in Chrome. On an iPhone or iPad, add the signer page to your Home Screen first, open it from there and scan the code inside it. A Home Screen page keeps its own storage, apart from Safari, and only it can receive notifications.

  2. Step 2

    Read the warning

    The page shows the wallet it is pairing with and what a compromised version of the page could do. Read it before you go on.

  3. Step 3

    Write down 24 words

    The page makes your policy key on the phone and shows it as 24 words. Write them on paper, in order, and keep the paper away from the agent’s machine. They are the only way back if the phone is lost or its browser storage is cleared.

  4. Step 4

    Lock the key

    Choose a passkey, which opens with your face or fingerprint. If your phone’s passkeys cannot do this, the page asks for a passphrase of at least 12 characters instead. The key stays on the phone, locked.

  5. Step 5

    Compare the codes

    The phone and the agent’s machine each show a six-digit code. Type yes on the agent’s machine only if the two codes match. Anyone who saw the QR code could try to answer it, and a code that differs means another device did. If two devices answer, the pairing fails and you start again.

  6. Step 6

    Set up the treasury

    Run satsgate owner treasury setup on the agent’s machine. The phone receives the treasury’s details and checks that they include its own key. It then shows the wallet id and a short fingerprint for each key. Check them against what the agent’s machine and your recovery signer printed. Then turn on notifications.

Approving a request

When a request waits, your phone shows a notification that says only “A request is waiting for your approval”. It carries no amounts and no addresses. Open the page to see the request. With notifications off, requests wait until you open the page.

What the review shows
Who gets paid and how much, the address, how much leaves the treasury, the mining fee, the change that comes back and the time left to decide. For a purchase, the merchant and what it is for come from the wallet service, and the page says it cannot check them.
Approve
Tap Approve and sign, then unlock the key with your passkey or passphrase. The phone signs that exact transaction and sends the signature back. The agent's machine adds the agent's signature and sends the transaction.
Reject
Tap Reject. The phone sends the refusal, and the coins the request had set aside are free again.
Asked twice
If the same request arrives again, the phone gives the same answer. A changed transaction is a new request and needs a new decision.

The three keys

Each key is kept in a different place, and each does only part of the job. The policy key on your phone cannot move anything on its own.

Agent key

On the agent's machine, held by the wallet service.

Can

  • Spend the allowance on its own.
  • Add the other signature a treasury spend needs, once you have signed.

Cannot

  • Move the treasury on its own.
  • Move the treasury together with the recovery key.

Policy key

On your phone, locked by a passkey or a passphrase. Your 24 words are its backup.

Can

  • Sign the treasury spends you approve, alongside the agent key.
  • Move the whole treasury to an address of yours, together with the recovery key.

Cannot

  • Move anything on its own.
  • Spend the allowance.

Recovery key

Offline, made with the owner command line on a computer kept apart from the agent's machine.

Can

  • Move the whole treasury together with the policy key, at any time.
  • Move a treasury coin on its own once the coin is 12,960 blocks old, about ninety days.

Cannot

  • Move a younger coin on its own.
  • Spend together with the agent key.

If you lose your phone

The treasury stays where it is, because the phone’s key cannot move it alone. The agent keeps buying from its allowance, and treasury requests wait.

  1. Step 1

    Bring the key back from your words

    Type the 24 words into satsgate-signer, the owner command line, on a computer the agent cannot reach. It makes the same key and signs requests as files, with no Satsgate site involved. The same applies if the phone’s browser storage was cleared.

  2. Step 2

    Decide whether the old copy is safe

    Restoring the words does not cancel the copy on the lost phone. If someone else may have the phone, or you no longer trust it or the page, treat the key as lost.

  3. Step 3

    Move the treasury if you need to

    With the policy and recovery keys together, you can move the whole treasury to an address of your own. If the words are lost as well, the recovery key on its own can move each treasury coin once it is about ninety days old. Moving to a new policy key means a new treasury and a transfer to it, which the wallet does not offer yet.

The mechanism

How the phone signer works gives the exact mechanism for engineers checking the design: the treasury script, the vault, pairing, transport, the review checks, notifications, release checks and recovery, each traced to the wallet’s source.