# The wallet in MLX Node

From MLX Node 0.12 the MLX Wallet is native in the panel. Its seed lives once on the Mac, in a keychain item, and every transaction it sends is signed on the Mac after Touch ID or the Mac's password.

The wallet is the same one as at wallet.mlx.app: the same 24 words, the same keys, the same transactions. The code is `mac/MLX/Wallet/` (`NativeWallet.swift` for state and signing, `Ledger.swift` for mlx.app's API) on top of MLXKit (`kit/`), MLX's shared Swift package.

## Where the seed lives

One generic-password item in the data protection keychain, access group `CCKXS9W488.app.mlx.wallet` (MLXKit `SharedWallet`):

- the wallet's name is the item's account attribute, readable without unlocking, so balances and activity show at once from public data;
- the 32-byte seed is the item's secret, released only after Touch ID or the Mac's password (`userPresence`), and never synced (this Mac only).

**Remove from this Mac** (wallet settings) deletes that item; the wallet itself stays on the ledger, and its 24 words or a passkey bring it back.

## Getting a wallet onto the Mac

- **Create.** Pick a name, write down 24 words, check three of them. MLX Node sends `create_account` from the new name at nonce 0, signed by the new key, then keeps the seed in the keychain.
- **Sign in with a passkey.** The passkey's user handle is the seed, the same as wallet.mlx.app and MLX.app make (relying party `mlx.app`).
- **Enter the 24 words.**

In both sign-in cases MLX Node derives the wallet key and finds its name with [GET /api/key/{pk}](/network/accounts#key).

## Signing

Every transaction is built and signed on the Mac (MLXKit `MLXSign.transaction`, the same hash and Ed25519 signature as the web wallet) and sent to [POST /api/tx](/transactions/submitting) with the account's next nonce. MLX Node asks for Touch ID or the Mac's password before every action that moves money or shows the 24 words:

| Action | Transaction |
| --- | --- |
| Send on the MLX Network | `transfer` (MLX, USDC; a 64-hex address is resolved to its wallet first) |
| Send on the Solana Network | `withdraw` with `chain: "solana"` (USDC, minimum 10, fee 0.5) |
| Swap | `swap` with `minOut` from [GET /api/market/quote](/network/market) |
| Get a dedicated seat from the balance | `buy_node` with `pay: "WALLET"` and a `maxMlx` cap when MLX is sold for it |
| Give a seat | [transfer_seat](/transactions/types#transfer-seat) |
| Link this Mac | `bind_device`, with this Mac's own signature as the proof (see [Links](/node/links#linking-a-mac-to-a-wallet)) |

Reads that need the wallet's signature (the wallet's seats and Macs from `GET /api/companion/me`, the US confirmation from `GET /api/attest`) use the key kept in memory after the first unlock, until the Mac sleeps or locks its screen.

Deposits, and receiving from another network, use the same checkout as the web wallet (`POST /api/pay`): pick the network and coin, the amount, and whether it arrives as MLX or USDC; then send exactly the amount shown, to the address shown, before the timer runs out. Buying MLX and dedicated seats asks once for the [not-a-US-person confirmation](/network/us-persons).

## What opens in the browser

Explorer pages (a transaction, a seat, the wallet's full history) and wallet.mlx.app (each token page has a small "Open in browser") open in the default browser. Nothing else in the wallet is a web page.