Smart Wallets for RWA Apps

Use Tatum to build Real World Asset (RWA) platforms that connect to many blockchains through one gateway, read standardized on-chain data, react to asset events as they happen, and sign issuance and transfer transactions through non-custodial MPC wallets, without running your own nodes for every chain you support.

RWA apps bring traditional, off-chain assets onto the blockchain so they can be held, transferred, fractionalized, or used as collateral the way crypto-native tokens are. That includes tokenized treasuries and government bonds, real estate and fractional property platforms, private credit and lending products, commodity-backed tokens such as gold, energy and carbon credit markets, and retail fractionalization apps that let smaller investors buy a slice of a larger asset.

Platform resources

• RPC Gateway: unified access to blockchain nodes across chains
• Blockchain Data API: standardized balances, ownership, and transaction data
• Notifications: real-time webhooks for on-chain events
• Exchange Rates API: token and fiat pricing for valuing assets
• Wallet SDK: non-custodial MPC wallets for issuance and transfer signing

What an RWA app should include

An RWA platform needs more than a token contract. Design the product around reliable multi-chain connectivity, accurate asset and ownership data, real-time visibility into transfers and collateral changes, and secure handling of high-value, real-world-backed tokens.

Common RWA use cases

Institutional treasury tokenization

Issue and track tokenized government bonds or money market instruments, where institutions need reliable on-chain data and audit-ready transaction history across the chains they operate on.

Real estate and fractional ownership

Tokenize a property or a real estate fund and let multiple investors hold a fractional, transferable share, with on-chain data and notifications keeping each investor's position accurate in real time.

Private credit and lending

Build platforms where loans are originated, tracked, or collateralized on-chain, using ownership and transaction data to monitor collateral health and trigger alerts on relevant changes.

Commodity-backed tokens

Support tokens backed by physical assets such as gold, where users expect the on-chain token supply and their own balance to reliably reflect the underlying holdings.

Energy and carbon credit markets

Track issuance, transfer, and retirement of energy or carbon credit tokens, where accurate event history matters for both buyers and any compliance reporting your platform supports.

Retail fractionalization apps

Let everyday users buy small fractions of larger real-world assets, combining straightforward balance and ownership views with dependable infrastructure underneath.

How the stack fits together

An RWA app typically layers four pieces of Tatum infrastructure underneath its own product:

1. RPC Gateway: your backend's entry point to the blockchain or blockchains your tokenized assets live on, with routing, failover, and load balancing handled for you.
2. Blockchain Data API: the source of truth your app queries for balances, ownership, and transaction history, instead of parsing raw chain data yourself.
3. Notifications: the real-time layer that tells your backend when a transfer, mint, burn, or other relevant event happens, so your app doesn't have to poll the chain.
4. Wallet SDK: the MPC signing layer that executes transactions for issuance, transfers, or redemptions using a 2-of-2 threshold model, your backend holds the client share and Tatum's enclave holds its own share, so neither side can sign alone and your application never handles a complete private key.

Architecture diagram

Use this minimal flow to place Tatum's RWA infrastructure inside your platform.

flowchart LR
A[RWA platform UI] --> B[Asset orchestration service]
B --> C[Tatum RPC Gateway]
B --> D[Tatum Blockchain Data API]
B --> E[Tatum Wallet SDK - MPC signing]
C --> F[Tokenized asset on-chain]
D --> F
E --> F
F --> G[Tatum Notifications]
G --> B

Your platform UI shows balances, ownership, and valuation, while your asset orchestration service is the only layer that talks to Tatum directly. It reads chain state through the RPC Gateway and Data API, signs through the Wallet SDK's MPC model, and listens for on-chain changes through Notifications, which feed back into your own balance and activity views.

Prerequisites

1. Decide which chains your RWA product needs to support, for example Ethereum, Polygon, or Tron.

2. Create or retrieve your Tatum API key.

3. Install the Tatum SDK and the Wallet SDK:

   Bash

   npm install @tatumio/tatum @tatumio/wallet-sdk

4. Store your API key as an environment variable:

   Bash

   export TATUM_API_KEY="your-api-key"

Basic implementation flow

Follow this flow when building an RWA app on Tatum.

1. Connect to your target chain or chains through the RPC Gateway, rather than running and maintaining your own nodes.
2. Read current asset state through the Blockchain Data API: balances, ownership, and transaction history for the tokenized asset.
3. Subscribe to relevant events through Notifications, such as transfers, mints, burns, or collateral updates.
4. Fetch valuation data through the Exchange Rates API when you need to show a fiat or reference value for the underlying asset.
5. Run your own compliance and approval checks before any issuance, transfer, or redemption, such as investor eligibility, transfer restrictions, or jurisdiction checks.
6. Sign and submit transactions through the Wallet SDK only after your checks approve the action, passing your stored client share so the enclave can combine it with its own share to produce a signature.
7. Update your platform's records when a Notification confirms the on-chain change, and keep an audit trail of issuance, transfers, and redemptions.

Example: read asset ownership data and subscribe to transfer events

The following example shows a backend service reading current token ownership and registering a webhook for future transfers. Use it as a starting point for an internal asset orchestration service, not directly from a browser or mobile client.

import { TatumSDK, Ethereum, Network } from "@tatumio/tatum";

const apiKey = process.env.TATUM_API_KEY;

if (!apiKey) {
  throw new Error("Set TATUM_API_KEY before running this script.");
}

async function readOwnershipAndSubscribe(tokenContract: string, holder: string) {
  const tatum = await TatumSDK.init<Ethereum>({
    network: Network.ETHEREUM,
    apiKey: { v4: apiKey },
  });

  try {
    const balance = await tatum.token.getBalance({
      tokenAddress: tokenContract,
      account: holder,
    });

    console.log(`Current holding for ${holder}:`, balance);

    const subscription = await tatum.notification.subscribe.incomingNativeTx({
      address: tokenContract,
      url: "https://your-backend.example.com/webhooks/rwa-transfer",
    });

    console.log("Subscribed to transfer notifications:", subscription.id);
  } catch (error) {
    console.error("RWA data operation failed:", error);
    process.exitCode = 1;
  } finally {
    await tatum.destroy();
  }
}

readOwnershipAndSubscribe(
  "0x0000000000000000000000000000000000000000",
  "0x1111111111111111111111111111111111111111"
);

The exact method names and payloads depend on the chain and SDK version you use. In production, store the subscription ID, link incoming webhook events to the underlying asset record, and reconcile balances against your own ledger.

Example: sign an asset transfer with the Wallet SDK

The following example shows the custodian-to-client flow for an issuer-side wallet that signs a transfer of a tokenized asset. Use it as a starting point for your asset orchestration service, not directly from a browser or mobile client.

import { TatumWalletsSdk, WalletChain } from "@tatumio/wallet-sdk";

const apiKey = process.env.TATUM_API_KEY;

if (!apiKey) {
  throw new Error("Set TATUM_API_KEY before running this script.");
}

const wallets = new TatumWalletsSdk({
  apiKey,
  baseUrl: "https://api.tatum.io",
});

async function createIssuerWalletAndTransferAsset() {
  try {
    const issuerClient = await wallets.custodian.createClient({
      body: {
        isAccountAbstracted: false,
      },
    });

    if (!issuerClient.clientApiKey) {
      throw new Error(
        "Client was created, but no client API key was returned."
      );
    }

    const client = wallets.initClient({
      token: issuerClient.clientApiKey,
    });

    const shares = await client.generateWallet();

    if (!shares.SECP256K1?.share) {
      throw new Error(
        "Wallet generation did not return a SECP256K1 signing share."
      );
    }

    // Run your own compliance and eligibility checks here before signing:
    // investor eligibility, transfer restrictions, jurisdiction checks.
    const transferApproved = true;

    if (!transferApproved) {
      throw new Error("Transfer was rejected by the compliance workflow.");
    }

    const result = await client.sendAssets({
      body: {
        share: shares.SECP256K1.share,
        chain: WalletChain.ETHEREUM_MAINNET,
        to: "0x0000000000000000000000000000000000000000",
        token: "NATIVE",
        amount: "0.01",
      },
    });

    console.log("Asset transfer submitted:", result);
  } catch (error) {
    console.error("Asset transfer failed:", error);
    process.exitCode = 1;
  }
}

createIssuerWalletAndTransferAsset();

Neither your stored client share nor Tatum's enclave share is sufficient to sign alone, so a compromised backend still cannot move assets without the enclave, and a compromised enclave still cannot move assets without your stored share. Encrypt and store the client share the same way you would any other sensitive credential, and keep a backup share on file through the SDK's backup workflow in case you need to recover the wallet.

Security and compliance responsibilities

Tatum gives you the connectivity, data, and signing infrastructure, but your platform remains responsible for the legal and operational controls around tokenized real-world assets.

Implement the following controls before production launch:

1. Protect API keys in backend systems. Do not expose them in browsers or mobile apps.
2. Encrypt and store client shares before persisting them. The Wallet SDK returns your client share from generateWallet(), but it does not encrypt it for you, so encrypt it per user before storage and never log it in plaintext.
3. Apply investor and transfer eligibility checks before issuance, transfer, or redemption, since most RWA products carry securities, KYC, or AML obligations that the blockchain layer does not enforce on its own.
4. Reconcile on-chain data against your books regularly, using the Blockchain Data API and Notifications as inputs, not as your sole system of record.
5. Log every issuance, transfer, and redemption with asset ID, holder ID, request ID, chain, transaction hash, and outcome.
6. Separate duties between compliance, operations, and engineering teams for issuance approvals and exception handling.

Choosing chains for your RWA app

Different chains suit different RWA use cases. Ethereum remains the most established environment for tokenized assets and DeFi integrations, with broad tooling for standard token formats.

Recommended architecture

Use a backend-controlled architecture for RWA deployments:

1. Platform UI: shows balances, ownership, valuation, and activity to issuers, investors, or operators.
2. Asset orchestration service: the only layer that calls Tatum directly, coordinating reads, writes, and event handling.
3. Compliance and approval layer: applies eligibility, transfer restriction, and jurisdiction checks before any on-chain action.
4. Wallet SDK (MPC signing): signs transactions only after compliance and approval checks pass, using your stored client share combined with Tatum's enclave share.
5. Reconciliation and audit: keeps your own ledger in sync with on-chain state and records every action for audit purposes.

This architecture keeps chain connectivity, data, and signing behind your platform's own compliance and operational controls, which matters more for RWA products than for purely crypto-native tokens.