The wallet in MLX Node
From MLX Node 0.12 the MLX Wallet is native in the panel. Its seed lives once on the Mac, in a keychain item, and every transaction it sends is signed on the Mac after Touch ID or the Mac's password.
The wallet is the same one as at wallet.mlx.app: the same 24 words, the same keys, the same transactions. The code is mac/MLX/Wallet/ (NativeWallet.swift for state and signing, Ledger.swift for mlx.app's API) on top of MLXKit (kit/), MLX's shared Swift package.
Where the seed lives
One generic-password item in the data protection keychain, access group CCKXS9W488.app.mlx.wallet (MLXKit SharedWallet):
- the wallet's name is the item's account attribute, readable without unlocking, so balances and activity show at once from public data;
- the 32-byte seed is the item's secret, released only after Touch ID or the Mac's password (
userPresence), and never synced (this Mac only).
Remove from this Mac (wallet settings) deletes that item; the wallet itself stays on the ledger, and its 24 words or a passkey bring it back.
Getting a wallet onto the Mac
- Create. Pick a name, write down 24 words, check three of them. MLX Node sends
create_accountfrom the new name at nonce 0, signed by the new key, then keeps the seed in the keychain. - Sign in with a passkey. The passkey's user handle is the seed, the same as wallet.mlx.app and MLX.app make (relying party
mlx.app). - Enter the 24 words.
In both sign-in cases MLX Node derives the wallet key and finds its name with GET /api/key/{pk}.
Signing
Every transaction is built and signed on the Mac (MLXKit MLXSign.transaction, the same hash and Ed25519 signature as the web wallet) and sent to POST /api/tx with the account's next nonce. MLX Node asks for Touch ID or the Mac's password before every action that moves money or shows the 24 words:
| Action | Transaction |
|---|---|
| Send on the MLX Network | transfer (MLX, USDC; a 64-hex address is resolved to its wallet first) |
| Send on the Solana Network | withdraw with chain: "solana" (USDC, minimum 10, fee 0.5) |
| Swap | swap with minOut from GET /api/market/quote |
| Get a dedicated seat from the balance | buy_node with pay: "WALLET" and a maxMlx cap when MLX is sold for it |
| Give a seat | transfer_seat |
| Link this Mac | bind_device, with this Mac's own signature as the proof (see Links) |
Reads that need the wallet's signature (the wallet's seats and Macs from GET /api/companion/me, the US confirmation from GET /api/attest) use the key kept in memory after the first unlock, until the Mac sleeps or locks its screen.
Deposits, and receiving from another network, use the same checkout as the web wallet (POST /api/pay): pick the network and coin, the amount, and whether it arrives as MLX or USDC; then send exactly the amount shown, to the address shown, before the timer runs out. Buying MLX and dedicated seats asks once for the not-a-US-person confirmation.
What opens in the browser
Explorer pages (a transaction, a seat, the wallet's full history) and wallet.mlx.app (each token page has a small "Open in browser") open in the default browser. Nothing else in the wallet is a web page.