Skip to main content

Watch-only Wallets

Reading and spending are separate capabilities in Orbinum. A viewing key lets an accountant, auditor or dashboard see what you hold without any ability to move it.

Because v3 derives every secret as a separate branch of your seed, read access can be handed out without spend authority. exportViewingCredential produces a credential that omits the spending key by type — not by a runtime check, so a credential cannot carry spend authority by accident.

Custody code — not publicly installable

@orbinum/wallet-sdk is a private package. This snippet shows the shape of the inputs, not something you can install and run. Reaching this API requires wallet SDK access.

import { deriveIdentity, exportViewingCredential } from '@orbinum/wallet-sdk';

const identity = deriveIdentity(rootSecret, 'v3');

// Sees what arrived. Cannot spend, cannot see what you paid.
const readOnly = exportViewingCredential(identity);

// Adds payment history — hand this over only deliberately.
const auditor = exportViewingCredential(identity, { includeOutgoing: true });

includeOutgoing is opt-in for a reason: the incoming key reveals what you received, while the outgoing key reveals who you paid. The second is the payment graph, a strictly larger secret than a list of amounts.

Spending needs two branches, not one

A v3 spending key on its own decrypts nothing and spends nothing. The scalar that spends a received note is derived from the shared secret, which comes from the viewing key — so a wallet has to hold both. Back up the root, not one key.