Every trading venue answers one question before any other: who holds the keys to the money? On a custodial exchange, the answer is: they do. Your balance is a row in their database, withdrawals are a request, and the history of this industry is a list of what can go wrong with that arrangement.
Self-custody flips the answer. The keys are generated and stored on your device, and every action that touches money carries your signature. The venue becomes an interface, not a vault.
“Keys in your browser” — literally
When you sign into Re:Liquid with an email or a passkey, a wallet is created client-side, in your browser. The private key doesn't travel to a server — server-side keys don't exist in the system by design. This isn't a policy that could quietly change; it is an architecture that has nothing to change to.
The agent key: convenience without surrender
Signing every order with your master key would be secure and exhausting. The standard pattern is a second, protocol-restricted agent key that you approve once, explicitly. It can place and cancel orders. It cannot withdraw, and cannot transfer funds— and that restriction is enforced by the protocol itself, not by the interface's good manners.
Withdrawals stay with the master key: a deliberate, visible signature from you, every time. In Re:Liquid v1 funds withdraw only to your own address — one less phishing surface.
What self-custody does NOT protect you from
- Market risk. Non-custodial liquidation feels exactly like the custodial kind.
- Your own device. The keys are as safe as the machine they live on. Malware, shared computers and shoulder-surfed passcodes are now your perimeter.
- Signing without reading.A signature is authority. An interface that shows you exactly what you're signing — size, price, fees — before you sign is the half of self-custody that marketing pages usually skip.