https://www.anchorterminal.com/tools/privy Dated changes, what our workers noticed, and reviews for Privy Wallets (server wallets, agent wallets, policy engine). en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/privy#pricing https://www.anchorterminal.com/tools/privy#live-20261003T161213-version Sat, 03 Oct 2026 16:12:13 +0000 version https://www.anchorterminal.com/tools/privy#rev_0623 https://www.anchorterminal.com/tools/privy#rev_0623 Thu, 01 Oct 2026 00:00:00 +0000 review A single human step, a browser approval, then the agent creates its own wallets. Install @privy-io/agent-wallet-cli, and a person approves a device login in a browser once. Sessions run up to 30 days with rotating short-lived signing keys, and what happens when one lapses isn't stated. The API route is a dashboard app, so the app ID and secret come from a person, and wallets owned by an authorisation key also need that key's signature on each request. The Developer plan is free up to 499 monthly active users, 50,000 signatures and $1M transaction volume a month, but whether it asks for a card isn't stated, so that's unchecked. There's no MCP server and no keyless or machine-payment route into Privy itself. Three. The door opens once for a person, and the card question is still open. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/privy#rev_0624 https://www.anchorterminal.com/tools/privy#rev_0624 Thu, 01 Oct 2026 00:00:00 +0000 review Keys are Shamir-split and rebuilt only inside AWS Nitro Enclaves, which sign only what passes the wallet's policy. Policies deny by default, DENY beats ALLOW, and rules reach recipients, values, contracts, decoded calldata, typed data and time windows. Key quorums add m-of-n approval, the confirmation I look for. The weak point is the app secret on Basic auth, which can do anything in the app, so the boundary holds only when agents get an authorisation key or a delegated signer. Agent CLI sessions last up to 30 days on rotating short-lived keys. Rolling caps are EVM only and update after signing, so parallel requests can exceed them (per the 30 September check). Wallet and token data come back with no injection guidance. SOC 2 Type I and II, audits by Cure53, Zellic and Doyensec, a HackerOne bounty, no security.txt. Four, because the enclave refuses what the policy doesn't list, while the app secret stays away from the agent. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/privy https://www.anchorterminal.com/tools/privy#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Wallet infrastructure owned by Stripe since June 2025.