Docs / Wallet roles
PayRam wallet roles: master account, deposit wallets, cold wallet and hot wallet
Wallets are what new merchants confuse most. This guide uses one table to show what each wallet does, who holds the keys and how much to keep in it.
The short version: PayRam uses four kinds of wallet. The master account deploys contracts, deposit wallets receive customer payments, the cold wallet holds your final funds, and the hot wallet only pays gas and sends payouts. Only the hot wallet's private key is stored on the server, which is why it holds just a small balance.
1. The four wallets at a glance
| Wallet | Role | Where the key is | How much to keep |
|---|---|---|---|
| Master account | Your browser wallet. Customer deposit addresses are derived from it, and it deploys the sweep contract | In your own wallet, never uploaded | Only enough gas to deploy the contract |
| Deposit wallet | The address a customer pays. One per order or per customer, all linked to the same master account | Not stored on the server | Funds are swept automatically, so nothing stays long |
| Cold wallet | Where funds finally land. It is never shown to customers | Known only to you. A hardware wallet is recommended | All of your takings |
| Hot wallet | Pays the gas for sweeps and sends refunds and other payouts | Stored encrypted on the server | Only a small working balance |
2. How money moves: from customer to cold wallet
- The customer sends the payment to the deposit address the system generated.
- Once the balance meets the trigger condition, the sweep contract moves the funds into your cold wallet without exposing any private key. The service fee is split within the same on-chain transaction.
- That on-chain sweep costs gas, and the hot wallet pays it.
- When a refund is due, you send it from the hot wallet to the customer.
Sweep triggers, thresholds and common questions are covered in SmartSweep explained.
3. The hot wallet: why its key lives on the server
Paying gas and sending refunds both need the system to sign transactions automatically, with no human present. So the hot wallet's private key has to be held by the system, stored encrypted on the server. It is the only key in the whole system that lives there.
On PayRamHost, the hot wallet is prepared by you. The platform does not provide one and does not pay gas or payout funds for you. Its key is stored on a server operated by the platform. Therefore:
- Use a dedicated new wallet. Never use the key of your master account or cold wallet.
- Keep only enough for gas and near-term payouts, and top it up regularly.
- Keep only an amount you are comfortable leaving there.
Hot wallets are set up per chain family: one for EVM (covering Ethereum, Base and Polygon) and one for Tron. Every project needs a hot wallet configured for the networks it receives on, there is no shared fallback, and one hot wallet can be assigned to several projects. The setup steps are in the merchant guide.
4. How much to keep in each
There is no universal figure because it depends on your volume. Here is how to estimate:
- Master account: a contract is deployed once per chain and costs gas once. Enough native coin for the deployment is all you need.
- Hot wallet: estimate two parts. One is sweep gas, which grows with volume and how often sweeps happen. The other is refunds, estimated from your refund total for the last month plus some margin. When the balance runs out, the system cannot pay gas or send payouts.
- Cold wallet: nothing needs to be there beforehand. It is where payments end up.
Turn on balance alerts under "Settings" so you are notified when the hot wallet runs low.
5. Five mistakes beginners make
- Using the master account or cold wallet as the hot wallet. That hands your most important key to the server.
- Keeping too much in the hot wallet. It is petty cash, not a vault.
- Entering the wrong cold wallet address. Funds are swept there automatically and a wrong address cannot be recovered. Compare it digit by digit with your hardware wallet screen, and enable one chain first to test.
- Forgetting to fund the hot wallet. The result is that customers pay but nothing is swept, and you cannot send refunds.
- Preparing native coin for each chain but funding only one. Ethereum and Base use ETH, Polygon uses POL. Each needs its own.
6. FAQ
Does the master account's private key get uploaded to the server?
No. The master account is your browser wallet, and you confirm the transaction in your wallet when deploying the contract. By design the deposit wallet keys never touch the server, and the only key on the server is the hot wallet's.
Can I skip the hot wallet?
No. Sweep gas and payouts are both paid from it, and without a hot wallet configured for the project you cannot send payouts.
If the hot wallet is stolen, are the funds in my cold wallet affected?
No. The cold wallet's key is never on the server, so the two are independent. That is also why the hot wallet holds only a small balance: if something goes wrong, the loss is limited.
What should I use as a cold wallet?
A hardware wallet is strongly recommended, and you should compare the address against the hardware screen every time it is changed.
Related reading
- SmartSweep: How SmartSweep moves funds from customer deposit addresses into your cold wallet: the three triggers (amount, address count, time), why small test payments are not swept, who pays the gas, and why Bitcoin is different.
- Refunds and payouts: On-chain payments have no chargeback, so refunds are manual. How PayRam payouts work: address book, approvals and one-time codes, limits, status meanings, and what to check before you refund.
- Merchant guide: A step-by-step guide to the PayRam merchant dashboard, from logging in to your first payment: nodes, wallets, hot wallet, payment links, the API and webhooks.