Reframe Wallet-as-a-Service doc around the platform offering

[lacrossehub]

Summary

The WaaS page led with the 2-of-2 root quorum as the defining pattern of Wallet-as-a-Service. This reframes the page around that, and moves co-signing into a new Hardening your platform section.

Changes

Framing. Intro, "What makes Wallet-as-a-Service different," and the transaction authorization flow now describe the baseline model: your platform holds the sole API key, end users authenticate to your platform, your backend approves. Turnkey stays behind your SDK. Added a note that this baseline is custodial, pointing to co-signing and custody models for teams that need verifiable non-custody.

Hardening your platform (new). Six optional controls, ordered by how often they'd apply: end-user co-signing (2-of-2), IP allowlisting, captcha, MFA policies, least-privilege API key scoping, and webhook-based activity monitoring. Each gets a one-line "when to use" and a link to the feature doc.

Implementation: five steps → three. The old Steps 1–3 split tenant mapping, the control model, and sub-org creation across two bullet lists that largely restated each other and the Architecture section above them. Now: create a sub-org per end user (with the end-user authenticator, Delegated Access, and export policy as clearly optional additions), build your integration surface, wire it into your platform flow. The staged 1-of-2 → 2-of-2 setup moved to the co-signing section, where it belongs.

Fact corrections

Checked each hardening claim against the underlying feature docs:

• IP allowlisting applies to the parent org only — sub-orgs don't inherit it and can't define their own, so requests authenticated against a sub-org (including your platform's transaction approvals) aren't evaluated. Added the fail-closed footgun (enabling with no CIDRs blocks all traffic) and corrected the tier to Enterprise clients on Scale or higher.
• Captcha enforcement is automatic only for @turnkey/react-wallet-kit v2.4.0+. Relevant here, since WaaS platforms typically build their own UI on @turnkey/core and must integrate Turnstile themselves.
• MFA policies are per-user via CreateMfaPolicy with an ordered list of required steps; added the session and OAuth factors.
• ACTIVITY_UPDATES covers the parent plus all sub-orgs from a single parent-owned endpoint.
• Export under 2-of-2 — explained the mechanism: root actions bypass the policy engine, but an explicit policy can let an individual root user act alone, which is what keeps the export escape hatch working.

Also

• Moved waas-tx-auth.png (the co-signing sequence diagram) from Architecture into the co-signing section it actually illustrates.
• Replaced the broken /get-started/about-turnkey#activities anchor — that page has no activities heading. Now points to #core-concepts.
• All other internal links verified to resolve to existing files.

Open question

The "When to use" row "You want per-user key isolation with no shared state" isn't WaaS-specific — consumer and business wallets get sub-org isolation too. Happy to drop it if reviewers agree it dilutes the table.

🤖 Generated with Claude Code