a stellar wallet//a point of sale//a quiet mode
Your keys never
leave this device.
StellarKey is three things in one app. A self-custody Stellar wallet. A point of sale that pays straight into it. And a private balance, in testnet preview, that keeps the amount, the recipient, and the memo to itself.
Local signing and records · direct Stellar requests · optional third-party services
- AES-256-GCMThe vault cipher, keyed by PBKDF2, encrypted here, never uploaded.
- 0Hosted StellarKey accounts or application custody services.
- DirectStellar requests, plus optional market-data, issuer and hardware services.
- 0 %Platform fee at the counter. There is no platform to pay.
the wallet//encrypted on device//hardware ready
A wallet that assumes nothing about you.
No account to create, no email to confirm, nobody to ask for your balance back.
the balance, the market, and a security posture the wallet scores itself
signing
Every signature reviewed before it happens
Destination, amount, memo, fee tier and the exact operations, laid out before anything is signed.
- Trezor signing, so the key never touches a browser
- Multi-sig with co-signers, weights and thresholds
- Batch disperse to many recipients in one transaction
- A security score that shows the gap before it matters
act two//the same wallet, behind a counter
Then it opens a till.
Merchant Mode turns the wallet into a point of sale. Same keys, same device, same account, with a counter on top. Everything below is optional: the wallet works perfectly well without ever switching it on.
how a sale works//four steps//no middle
Nothing sits between the customer and your account.
There is no in between, because there is no one in it. The till watches the public ledger and files the payment against the order itself.
- 01 / ring up
Build the ticket
Keypad or product tiles, with per-line VAT, modifiers and discounts worked out on device.
- 02 / tip
Ask, don’t assume
The customer is offered the tip before the code appears, never added quietly after.
- 03 / charge
Show the code
A SEP-7 request carrying a muxed Stellar address and the amount. The payment route is embedded in the address, so no memo is required.
- 04 / settle
It files itself
The till marks the order paid when the network payment is reported and matched.
you can check it//without trusting us
Every sale leaves a public receipt
This is the receipt StellarKey produces after a payment is matched. Order, exact asset amount, payer, transaction hash and ledger, together on one sheet, checkable by anyone you show it to.
representative testnet receipt · values are illustrative
| order | #1024 · MC-O-1024 |
| total | € 4.80 · VAT 23 % included |
| received | 22.3755101 XLM |
| payer | GC33 RABA … Z03U 7604 |
| transaction | ef3a 5dd7 … 016a b94f |
| ledger | 4,369,215 |
the counter
A till, not a checkout page
The ticket builds on the right while the keypad or the catalogue fills it. Staff are roles on this device, gated by a PIN, and every action is attributed to whoever is on shift.
- Owner, manager, server, accountant, each with its own rights
- Refund ceilings per role, and anything above becomes a request
- Five wrong PINs and the till pauses for thirty seconds
one qr//one payment route
The address carries the reconciliation
Each request has an immutable numeric route. Standard embeds it in a muxed Stellar address; Trezor uses the same route as a MEMO_ID with the classic shop address. StellarKey matches either form from the public ledger, on device.
- Underpaid and overpaid handled explicitly, not silently
- Anything unmatched lands in a tray instead of disappearing
- Charges keep running while the till serves the next customer
proof
A receipt that is also an audit trail
Lines, VAT by rate, the payer’s address, the transaction hash, how it was matched and the ledger it closed in, all on one sheet, ready for whoever asks.
records//computed locally//sent nowhere
And keeps the books where you can reach them.
the same strip opens orders, invoices, customers and insights
the records
Orders, catalogue, customers — kept here
Every record the till produces lives in this device’s encrypted storage, and each figure carries the payment that made it.
- Every sale with its payment, its ledger and its route
- A catalogue with per-item tax rates and stock
- Customers built from the addresses that actually paid you
- CSV exports that state their own row counts
the insights
It tells you what stands out
Tuesday is your quietest day. The 13:00 hour pays the rent. The facts worth acting on, written out rather than left in a chart.
- Today against what this weekday normally does
- VAT by rate over the period, refunds netted off
- The asset mix, at the rate each sale settled
the rest of the till//same device//no server
A counter’s worth of tools, none of them hosted.
Merchant records and reports, kept locally. Card tenders record payments handled by your separate card provider; StellarKey does not process cards. Each report comes from the till’s encrypted records.
- InvoicesDrafted, issued, and reconciled from the ledger like any sale. Overdue is a fact the app shows you, not an email it sends.
- Counter codesA printable poster that lives by the till. Fixed or open amounts, per-code assets, and a QR sized to scan from a customer’s reach.
- Customer displayThis device, turned around. The total flips 180°, the staff controls dim, and a PIN guards the way back.
- ShiftsAn opening float, tenders by kind, expected cash against counted cash, and the variance in writing at close.
- Tips before the codeThe tip question comes before the QR, with no tip given equal weight. Nothing is added quietly after.
- Per-line VATEvery line carries its own rate, so the period report is arithmetic, not archaeology.
- ExportsCSV reports that state their own row counts, and an encrypted archive for everything else.
- Peripherals, honestlyA barcode scanner that is just a keyboard, a cash drawer on the printer’s kick pulse. No pairing ceremony.
act three//the same wallet, in private
Then it goes quiet.
Private Payments is the same wallet with a second pocket. Move XLM or USDC into one private pool and send internally while the asset, amount, recipient, and memo stay encrypted. The proof is built on this device; a contract on the public Stellar ledger verifies the public proof without receiving its private witness.
Protocol V2 ships as an unaudited, Testnet-only feature. Money moving in or out of the private balance is public by design. The submitting account, fee payer and timing remain public. Privacy grows with more independent activity — it is context, not a guarantee.
a private payment//proved here//verified there
Payments that keep the amount to themselves.
There is no StellarKey transaction backend, indexer, or key service. After explicit intent, the wallet downloads and caches hash-pinned proving files, builds each proof in an isolated worker, and talks directly to the Stellar RPC endpoint you chose. A missing or corrupt cache is fetched again. Payments submit from your public account; RPC operators receive proofs and transactions and can observe request metadata.
the split//drawn exactly
What leaves your device.
Signing keys and the private witness stay on the device. Private-transfer details travel as encrypted output and recovery records; deposits and withdrawals expose their asset, amount and endpoint. The proof, public inputs, commitments, nullifiers and ciphertext are published on Stellar.
the surfaces//same geometry//representative values
This is what quiet looks like.
The surfaces below are drawn in this page’s own ink — the same layout, the same marks, the same honesty as the app’s screens, with representative values. The real thing runs on testnet today, one click away.
crossing in public
Adding funds is public. The result is not.
Moving money into the private balance is an ordinary Stellar transaction, and the review says so in plain words before you confirm. What you hold afterwards is nobody’s business but yours.
- The exact network fee, shown before anything is signed
- A balance-after table: 0, plus 100, equals 100
- The same honesty on the way out, like any public payment
receiving//no registry
An address that lives nowhere on chain
A shielded address is shared out-of-band, as a QR or a copy, and never registered anywhere. The short verification code under it lets the sender check they have the right one before any money moves.
the send and its review · the fee is public and says so · the rest is encrypted
the shield notch
One feed, wearing its provenance
Private and public activity share one list. The private rows wear a small Stellar shield on the direction circle; the public row beside them does not. That is the whole disclosure policy — visible, per row, in the feed you already read.
one glyph//three containers
One mark, three duties.
The official Stellar symbol, unmodified and at its native line weight, set in a lock for the wallet you own, a shield for the payments you keep quiet, and a receipt for the sales you can prove.
honest edges//no small print
The quiet part, said out loud.
- Deposits and withdrawals are publicCrossing between pockets shows its amount, its account and its timing on Stellar, like any public payment.
- The fee account is publicA private send is still a transaction, and the Stellar account paying its fee is visible, along with when.
- Privacy is context, not a guaranteeIt grows with more independent activity, and it can shrink with reuse and timing.
- A preview on testnet todayMainnet waits for independent audit and trusted-setup evidence. The app shows you that status table itself.
- Keep your phrase and encrypted backupSeed recovery needs the matching deployment and authenticated archive. Pending-proof holds and local metadata need the backup. Archive restoration can cost network fees.
- Testnet balances are worth nothingValues shown against private testnet assets are representative pricing only.
who it is for
Three people, one app.
- the counterSmall shops taking paymentA café, a market stall, a studio. You want the money and you do not want a third of a percent of every coffee going somewhere else.
- the holderPeople holding their own keysMulti-sig, hardware signing, watch-only accounts, and a private balance in testnet preview for the payments that are nobody else’s business. The vault never leaves the browser.
- the accountantWhoever does the booksVAT by rate, per-line tax, refunds netted off, and ledger references for confirmed crypto payments. Cash and external-card records need separate reconciliation.
limits//stated plainly
The limits of this release.
StellarKey is a local wallet and merchant tool, not a hosted payment processor or cloud service. These capabilities are not included; use independent services where you need them.
- ✕Host a merchant checkout serviceThe static app is hosted, but it does not operate per-merchant checkout sessions or a payment backend.
- ✕Sync two tillsShared state needs a shared database. One install is one terminal, and says so.
- ✕Chase an invoice on a timerSending email on a schedule means a machine awake when you are not.
- ✕Pay out to a bankThat is an anchor’s job, and an anchor is a custodian by another name.
- ✕Recover your password for youKeep your password, recovery phrase and tested encrypted backup. They protect different recovery paths.
- ✕Run application analyticsNo analytics, telemetry or hosted account. Hosts and third-party services can still observe requests, and Stellar transactions are public.
the awkward questions
Answered before you ask.
What if the price moves between the code and the payment?
The charge is quoted in your currency and converted at the moment it is raised, then held for the life of the request. If the payment arrives outside a tolerance you set, the till says underpaid or overpaid explicitly rather than rounding it away, and the difference is yours to settle, in cash or with a top-up charge.
What if my customer doesn’t have a Stellar wallet?
Then they cannot pay this way, and you take cash or a card instead. This is not a replacement for every payment method on day one; it is the one with no StellarKey processing fee when the customer does have a wallet. Be honest with yourself about your own customers before switching anything off.
Where does my money actually go?
Straight to the Stellar account you nominate, under your signing authority. StellarKey does not route public merchant payments through a custody account. Issued assets can still have issuer authorization, freeze or clawback controls; check the full asset identity and its terms.
What happens if I lose the device?
The matching recovery material restores signing authority for your accounts; a phrase does not restore separately imported keys or hardware accounts. Merchant records need a tested encrypted backup. Private Payments recovery also needs the matching deployment and authenticated archive; its unconfirmed proof holds and local metadata need the backup. Keep the wallet password and all relevant recovery material offline.
Is this legal for my shop?
Taking payment in a digital asset, and how it is taxed, depends on where you trade. The app records per-line VAT, totals by rate and ledger references for confirmed crypto payments. Cash and external-card records need separate evidence. It does not provide legal or tax advice; ask someone qualified where you trade.
Why can everyone see me adding money to a private balance?
Because crossing between pockets is a public Stellar transaction, and pretending otherwise would be a lie. Adding funds is public; the resulting private balance is not. Inside, the amount, the recipient, and the memo of a send stay encrypted. Step back out and the withdrawal is public again, like any Stellar payment.
What does it cost?
StellarKey charges no subscription or processing fee. The sender pays Stellar network fees, whose minimum is per operation and can rise during surge pricing. Conversion, spread, reserves, tax, and off-ramp services can add separate costs.
no signup//no custodian//first sale today
Start taking payments in minutes.
Create a vault, open the till, and show a payment code. No StellarKey account is required. Shop records stay local; crypto payments are public and selected network services can observe requests.
- 01
Create a vault
A password encrypts a new Stellar key in this browser. Write down the recovery phrase.
- 02
Turn on Merchant Mode
Name the shop, set your tax rates and tip presets, and choose which assets you accept.
- 03
Add it to the home screen
It installs as an app from the browser. No store, no review, no waiting.
- 04
Take a payment
Ring one up and show the code. Watch it settle against the order.