A stablecoin wallet API gives a business programmatic wallets for holding, receiving and sending stablecoins. The provider runs key storage, signing and blockchain broadcasting. The platform still chooses the custody model: either its backend controls the wallets, or each end user approves every transaction. That choice decides who can move funds, which controls the platform must build and which licensing questions it has to answer.
Two custody models
Circle and Coinbase Developer Platform (CDP) both split their wallet products by who controls signing.
| Platform-controlled | User-controlled | |
|---|---|---|
| Circle product | Developer-controlled wallets | User-controlled and modular wallets |
| CDP product | API key wallets | User wallets |
| Who authorizes a transfer | The platform’s backend | The end user, after signing in |
| Typical use | Payouts, treasury, deposits and withdrawals | Apps where users approve each payment |
| Who carries the custody question | The platform | The user holds the keys |
Circle describes developer-controlled wallets as “direct custody”: the platform holds key material on its users’ behalf. User-controlled and modular wallets are non-custodial. Circle states it does not offer fully custodial arrangements in which Circle itself holds keys for users.
CDP draws the same line. API key wallets are controlled by the developer’s server with a CDP API key and a Wallet Secret. User wallets are controlled by end users, and only the user can export the keys.
How the keys are secured
Neither provider hands a platform raw private keys.
- Circle developer-controlled wallets use 2-of-2 multi-party computation (MPC). MPC splits a key into shards so that no single party holds the full key. Signing is authorized with a 32-byte entity secret that the platform creates and stores. Circle says it never stores that secret, and losing it without a backup means losing access to the wallets it controls.
- Node hosting options: Circle can host both MPC nodes, share hosting with the platform, or, for enterprise customers, let the platform host both nodes with a keyguard service that approves every transaction.
- Circle modular wallets use passkeys kept in the user’s device secure enclave.
- CDP API key wallets keep private keys inside a Trusted Execution Environment run by CDP.
For a bank or payment company, the hosting option matters more than the cryptography. Shared or self-hosted nodes put an approval step on infrastructure the platform runs, which some compliance teams require.
Controls the platform must build
A wallet API does not decide whether a payment should happen. That logic stays with the platform.
Circle’s documentation says developer-controlled wallets have no built-in policy engine. Transaction limits, destination allowlists and multi-party approvals must run in the platform’s own code before it calls Circle. CDP describes policy-enforced spending limits for API key wallets, but a platform still has to define and maintain those rules.
Sanctions screening sits on both sides. Circle denies transactions that involve addresses on the OFAC sanctions list and temporarily restricts the wallet from outbound transfers pending review. It also places the obligation on the developer to keep its wallets away from listed addresses. Circle offers a separate Compliance Engine for rule-based transaction screening to eligible customers.
Circle also warns that a platform holding assets for end users may need a license in its jurisdiction. That is a legal question for each program, not a feature of the API.
Network fees and finality
Stablecoin transfers pay network fees in the chain’s native token. Wallet providers offer ways around that:
- Circle Gas Station sponsors fees for Circle wallets and bills the developer’s card, priced at 5% of the gas fee.
- Circle Paymaster lets users pay fees in USDC from any ERC-4337 wallet, priced at 10% of the gas fee and paid by the user.
On EVM chains, Gas Station needs smart contract accounts (SCA) rather than externally owned accounts (EOA).
Submission is not settlement. Circle’s API response confirms that a transaction was sent, not that the chain finalized it. Status changes arrive later by webhook, so a ledger should post a transfer as pending until the confirmation event arrives. The same rule applies to the stablecoin on/off-ramp API steps that sit before and after the wallet.
Choosing a model
Platform-controlled wallets fit stablecoin payouts, treasury and exchange-style deposit flows, where the business must move funds without asking a user each time. They also put custody, recordkeeping and licensing on the platform.
User-controlled wallets fit products where the user should approve every payment. They shift key control to the user but add recovery flows: Circle uses security questions for forgotten PINs, and passkey users rely on device or cloud backups.
The wider stack around wallets, from issuers to ramps, is covered in stablecoin infrastructure.
