> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Wallets

> Authenticate a server-side agent with a Dynamic user JWT and a session key, then create wallets and sign — on behalf of a human user or fully autonomously.

Agent wallets let a server-side agent (for example, an AI agent or an automated trading service) operate a Dynamic embedded wallet as a Dynamic user. The agent authenticates with a user JWT instead of your developer API token, so every wallet it creates or signs with belongs to that user.

To compare agent wallets with **server wallets** and **delegated access**, see [Agents Overview](/docs/overview/agents/overview).

The user can be:

* **A human** — the agent signs them in with email OTP (the human relays the code) or a wallet signature (the human signs the sign-in message with their own wallet), then acts on their behalf.
* **The agent itself** — the agent authenticates with an **agent signing token**: a secp256k1 private key that the agent holds, which serves as its identity. It signs in programmatically and mints its own JWT — no human in the loop, including at re-authentication time.
* **An identity from your own auth system** — the agent signs in by exchanging a JWT from your configured external issuer for a Dynamic user JWT. Whatever your identity or authorization system attests — a human user or an agent registered as its own principal — becomes a Dynamic user, and each distinct JWT `sub` is a distinct user with its own wallets, so a fleet of agents never shares a user or a credential.

This differs from the other two ways to authenticate the Node SDK:

* **API token** (`authenticateApiToken`) — your server-level credential. Wallets belong to your developer account. See the [Node SDK Quickstart](/docs/node/quickstart).
* **Delegated access** (`createDelegatedEvmWalletClient`) — the user approves delegation in your client app and Dynamic sends credentials to your webhook. See [Delegated Access for EVM Wallets](/docs/node/evm/delegated-access).
* **Agent wallets** (`authenticateJwt`) — the agent completes a Dynamic sign-in directly (email OTP, Sign-In With Ethereum, or an external JWT), receives a user JWT, and acts as that user. No browser required, and with an agent signing token or an external JWT, no human required.

<Note>
  Before you start: Node.js 18+, a Dynamic environment ID from the [Dynamic Dashboard](https://app.dynamic.xyz/dashboard/developer/api), embedded wallets enabled for your environment, and the sign-in method your agent uses enabled in the dashboard — email or external wallet under [auth methods](/docs/overview/authentication/dynamic-auth/auth-methods), or [third-party auth](/docs/overview/authentication/bring-your-own-auth) (issuer, JWKS URL, audience) for external JWT sign-in. Install `@dynamic-labs-wallet/node` version 1.0.71 or later (auth client and session-key helpers) alongside your chain package, for example `@dynamic-labs-wallet/node-evm`.
</Note>

The examples in this section use the EVM client. `DynamicSvmWalletClient`, `DynamicBtcWalletClient`, and `DynamicTonWalletClient` inherit the same authentication methods.

## How the flow works

1. Generate a session key pair. The public key travels; the private key stays in your custody.
2. Sign in — with [email OTP](/docs/node/agents/sign-in-with-email-otp) (human user), [a private key](/docs/node/agents/sign-in-with-a-private-key) (human user or autonomous agent), or [an external JWT](/docs/node/agents/sign-in-with-an-external-jwt) (identity from your own auth system) — and pass the session public key, which binds it into the minted JWT.
3. [Use agent wallets](/docs/node/agents/use-agent-wallets): call `authenticateJwt` with the JWT and a `getSessionSignature` callback, then create wallets and sign with `backUpToDynamic: true`. The SDK attaches a signed-session proof to backup and recovery calls automatically.
4. Refresh the JWT with `refreshAuthToken` for long-running sessions, and sign in again when the refresh limit is reached.

For complete runnable scripts covering each sign-in path, see [Example Usage](/docs/node/agents/example-usage). For what your application must persist and the security model, see [Storage & Security](/docs/node/agents/storage-and-security).

## API reference

* [authenticateJwt](/docs/node/reference/auth/authenticate-jwt)
* [refreshAuthToken](/docs/node/reference/auth/refresh-auth-token)
* [generateSessionKeyPair](/docs/node/reference/auth/generate-session-key-pair)
* [signSessionMessage](/docs/node/reference/auth/sign-session-message)
* [createAuthClient](/docs/node/reference/auth/create-auth-client)
* [Email OTP sign-in](/docs/node/reference/auth/email-otp-sign-in)
* [Wallet sign-in](/docs/node/reference/auth/wallet-sign-in)
* [External JWT sign-in](/docs/node/reference/auth/external-jwt-sign-in)