Repository: vegaprotocol/go-wallet
Pull request #109 (2021-06-24 17:25:53)

Rework storage layer
- [x] Extract service in own package
- [x] Make CLI use the Handler
- [x] Extract config storage layer


Patch:
diff --git a/README.md b/README.md
index 8ed69d3..03ae66f 100644
--- a/README.md
+++ b/README.md
@@ -98,7 +98,7 @@ You’ll see an output with your public and private key. DO NOT SHARE YOUR PRIVA
 > Tip: You can also use the meta command to tag a key with other data you might want, using a property name and a value. This will be useful for developing with Vega Wallet in the future.
 
 ## Run the Wallet service
-Now, **connect your Wallet to the Testnet nodes**. The `init` command (below) will initialise the configuration. A configuration file will be stored in your home folder, in a folder called `.vega`.
+Now, **connect your Wallet to the Testnet nodes**. The `init` command (below) will initialise the configuration. A configuration file will be stored in your home folder, in a folder called `.vega`.
 
 **MacOS & Linux**
 
@@ -140,7 +140,7 @@ If you'd like more information or guidance, there are instructions in the [Vega
 If you'd prefer to request tokens from the contracts directly, there are instructions in the [testnet bridge tools repo readme](https://github.com/vegaprotocol/Public_Test_Bridge_Tools/blob/master/docs/mew.md).
 
 ### Use the wallet API
-Using the API is documented [here](./wallet/README.md).
+Using the API is documented [here](service/README.md).
 
 ## Support
 
diff --git a/cmd/console.go b/cmd/console.go
index e8ee1f5..f31bae1 100644
--- a/cmd/console.go
+++ b/cmd/console.go
@@ -47,10 +47,6 @@ func (c *consoleProxy) Start() error {
 		Handler: &proxy,
 	}
 
-	// c.log.Info("starting console proxy",
-	// 	zap.String("proxy.address", consoleProxyAddr),
-	// 	zap.String("address", c.consoleURL),
-	// )
 	return c.s.ListenAndServe()
 }
 
diff --git a/cmd/genkey.go b/cmd/genkey.go
index 7e8f16c..3c5c4b0 100644
--- a/cmd/genkey.go
+++ b/cmd/genkey.go
@@ -5,137 +5,120 @@ import (
 	"fmt"
 	"strings"
 
-	"code.vegaprotocol.io/go-wallet/fsutil"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"code.vegaprotocol.io/go-wallet/wallet"
-	"code.vegaprotocol.io/go-wallet/wallet/crypto"
+
 	"github.com/spf13/cobra"
 )
 
 var (
-	genkeyArgs struct {
+	genKeyArgs struct {
 		walletOwner string
 		passphrase  string
 		metas       string
 	}
 
-	// genkeyCmd represents the genkey command
-	genkeyCmd = &cobra.Command{
+	// genKeyCmd represents the genkey command
+	genKeyCmd = &cobra.Command{
 		Use:   "genkey",
 		Short: "Generate a new keypair for a wallet",
 		Long:  "Generate a new keypair for a wallet, this will implicitly generate a new wallet if none exist for the given name",
-		RunE:  runGenkey,
+		RunE:  runGenKey,
 	}
 )
 
 func init() {
-	rootCmd.AddCommand(genkeyCmd)
-	genkeyCmd.Flags().StringVarP(&genkeyArgs.walletOwner, "name", "n", "", "Name of the wallet to use")
-	genkeyCmd.Flags().StringVarP(&genkeyArgs.passphrase, "passphrase", "p", "", "Passphrase to access the wallet")
-	genkeyCmd.Flags().StringVarP(&genkeyArgs.metas, "metas", "m", "", `A list of metadata e.g: "primary:true;asset:BTC"`)
+	rootCmd.AddCommand(genKeyCmd)
+	genKeyCmd.Flags().StringVarP(&genKeyArgs.walletOwner, "name", "n", "", "Name of the wallet to use")
+	genKeyCmd.Flags().StringVarP(&genKeyArgs.passphrase, "passphrase", "p", "", "Passphrase to access the wallet")
+	genKeyCmd.Flags().StringVarP(&genKeyArgs.metas, "metas", "m", "", `A list of metadata e.g: "primary:true;asset:BTC"`)
 }
 
-func runGenkey(cmd *cobra.Command, args []string) error {
-	if len(genkeyArgs.walletOwner) <= 0 {
+func runGenKey(cmd *cobra.Command, args []string) error {
+	store, err := storev1.NewStore(rootArgs.rootPath)
+	if err != nil {
+		return err
+	}
+
+	handler := wallet.NewHandler(store)
+
+	if len(genKeyArgs.walletOwner) == 0 {
 		return errors.New("wallet name is required")
 	}
-	if len(genkeyArgs.passphrase) <= 0 {
+
+	walletExists := handler.WalletExists(genKeyArgs.walletOwner)
+
+	if len(genKeyArgs.passphrase) == 0 {
 		var (
 			err          error
 			confirmation string
 		)
-		genkeyArgs.passphrase, err = promptForPassphrase()
+		genKeyArgs.passphrase, err = promptForPassphrase()
 		if err != nil {
 			return fmt.Errorf("could not get passphrase: %v", err)
 		}
 
-		// if wallet does not exists
-		// ask for passphrase confirmation + check it's not empty
-		if !wallet.WalletFileExists(rootArgs.rootPath, genkeyArgs.walletOwner) {
+		if len(genKeyArgs.passphrase) == 0 {
+			return fmt.Errorf("passphrase cannot be empty")
+		}
+
+		if !walletExists {
 			confirmation, err = promptForPassphrase("please confirm passphrase:")
 			if err != nil {
 				return fmt.Errorf("could not get passphrase: %v", err)
 			}
 
-			if genkeyArgs.passphrase != confirmation {
+			if genKeyArgs.passphrase != confirmation {
 				return fmt.Errorf("passphrases do not match")
 			}
-
-			if len(genkeyArgs.passphrase) <= 0 {
-				return fmt.Errorf("passphrase cannot be empty")
-			}
-		}
-	}
-
-	if ok, err := fsutil.PathExists(rootArgs.rootPath); !ok {
-		if _, ok := err.(*fsutil.PathNotFound); !ok {
-			return fmt.Errorf("invalid root directory path: %v", err)
-		}
-		// create the folder
-		if err := fsutil.EnsureDir(rootArgs.rootPath); err != nil {
-			return fmt.Errorf("error creating root directory: %v", err)
 		}
 	}
 
-	if err := wallet.EnsureBaseFolder(rootArgs.rootPath); err != nil {
-		return fmt.Errorf("unable to initialization root folder: %v", err)
+	metas, err := parseMeta(genKeyArgs.metas)
+	if err != nil {
+		return err
 	}
 
-	wal, err := wallet.Read(rootArgs.rootPath, genkeyArgs.walletOwner, genkeyArgs.passphrase)
-	if err != nil {
-		if err != wallet.ErrWalletDoesNotExists {
-			// this an invalid key, returning error
-			return fmt.Errorf("unable to decrypt wallet: %v", err)
-		}
-		// wallet do not exit, let's try to create it
-		wal, err = wallet.Create(rootArgs.rootPath, genkeyArgs.walletOwner, genkeyArgs.passphrase)
+	if !walletExists {
+		err := handler.CreateWallet(genKeyArgs.walletOwner, genKeyArgs.passphrase)
 		if err != nil {
-			return fmt.Errorf("unable to create wallet: %v", err)
+			return fmt.Errorf("couldn't create wallet: %v", err)
 		}
 	}
 
-	// at this point we have a valid wallet
-	// let's generate the keypair
-	// defaulting to ed25519 for now
-	algo := crypto.NewEd25519()
-	kp, err := wallet.GenKeypair(algo.Name())
+	keyPair, err := handler.GenerateKeyPair(genKeyArgs.walletOwner, genKeyArgs.passphrase)
 	if err != nil {
-		return fmt.Errorf("unable to generate new key pair: %v", err)
-	}
-
-	if len(genkeyArgs.metas) > 0 {
-		// expect ; separated metas
-		metasSplit := strings.Split(genkeyArgs.metas, ";")
-		for _, v := range metasSplit {
-			metaVal := strings.Split(v, ":")
-			if len(metaVal) != 2 {
-				return fmt.Errorf("invalid meta format")
-			}
-			kp.Meta = append(kp.Meta, wallet.Meta{Key: metaVal[0], Value: metaVal[1]})
-		}
-	}
-
-	// the user did not specify any metas
-	// we'll create a default one for them
-	if len(kp.Meta) <= 0 {
-		kp.Meta = append(
-			kp.Meta,
-			wallet.Meta{
-				Key:   "name",
-				Value: fmt.Sprintf("%v's key %v", genkeyArgs.walletOwner, len(wal.Keypairs)+1),
-			},
-		)
+		return fmt.Errorf("could not generate a key pair: %v", err)
 	}
 
-	// now updating the wallet and saving it
-	_, err = wallet.AddKeypair(kp, rootArgs.rootPath, genkeyArgs.walletOwner, genkeyArgs.passphrase)
+	err = handler.UpdateMeta(genKeyArgs.walletOwner, keyPair.Pub, genKeyArgs.passphrase, metas)
 	if err != nil {
-		return fmt.Errorf("unable to add keypair to wallet: %v", err)
+		return fmt.Errorf("could not update the meta: %v", err)
 	}
 
 	// print the new keys for user info
 	fmt.Printf("new generated keys:\n")
-	fmt.Printf("public: %v\n", kp.Pub)
-	fmt.Printf("private: %v\n", kp.Priv)
+	fmt.Printf("public: %v\n", keyPair.Pub)
+	fmt.Printf("private: %v\n", keyPair.Priv)
 
 	return nil
 }
+
+func parseMeta(metaStr string) ([]wallet.Meta, error) {
+	var metas []wallet.Meta
+
+	if len(metaStr) == 0 {
+		return metas, nil
+	}
+
+	rawMetas := strings.Split(metaStr, ";")
+	for _, v := range rawMetas {
+		rawMeta := strings.Split(v, ":")
+		if len(rawMeta) != 2 {
+			return nil, fmt.Errorf("invalid meta format")
+		}
+		metas = append(metas, wallet.Meta{Key: rawMeta[0], Value: rawMeta[1]})
+	}
+
+	return metas, nil
+}
diff --git a/cmd/init.go b/cmd/init.go
index 4570d02..95b3d84 100644
--- a/cmd/init.go
+++ b/cmd/init.go
@@ -1,19 +1,16 @@
 package cmd
 
 import (
-	"fmt"
-
-	"code.vegaprotocol.io/go-wallet/fsutil"
-	"code.vegaprotocol.io/go-wallet/wallet"
-
+	"code.vegaprotocol.io/go-wallet/config"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"github.com/spf13/cobra"
 	"go.uber.org/zap"
 )
 
 var (
 	initArgs struct {
-		force     bool
-		genRsaKey bool
+		force       bool
+		NoGenRsaKey bool
 	}
 
 	// initCmd represents the init command
@@ -28,24 +25,23 @@ var (
 func init() {
 	serviceCmd.AddCommand(initCmd)
 	initCmd.Flags().BoolVarP(&initArgs.force, "force", "f", false, "Erase exiting wallet service configuration at the specified path")
-	initCmd.Flags().BoolVarP(&initArgs.genRsaKey, "no-genrsakey", "g", false, "Do not generate rsa keys for the jwt tokens by default")
+	initCmd.Flags().BoolVarP(&initArgs.NoGenRsaKey, "no-genrsakey", "g", false, "Do not generate rsa keys for the jwt tokens by default")
 }
 
 func runServiceInit(cmd *cobra.Command, args []string) error {
-	if ok, err := fsutil.PathExists(rootArgs.rootPath); !ok {
-		if _, ok := err.(*fsutil.PathNotFound); !ok {
-			return fmt.Errorf("invalid root directory path: %v", err)
-		}
-		// create the folder
-		if err := fsutil.EnsureDir(rootArgs.rootPath); err != nil {
-			return fmt.Errorf("error creating root directory: %v", err)
-		}
+	log, err := zap.NewProduction()
+	if err != nil {
+		return err
 	}
 
-	log, err := zap.NewProduction()
+	store, err := storev1.NewStore(rootArgs.rootPath)
 	if err != nil {
 		return err
 	}
 
-	return wallet.GenConfig(log, rootArgs.rootPath, initArgs.force, !initArgs.genRsaKey)
+	if err := store.Initialise(); err != nil {
+		return err
+	}
+
+	return config.GenerateConfig(log, store, initArgs.force, !initArgs.NoGenRsaKey)
 }
diff --git a/cmd/list.go b/cmd/list.go
index ca454a3..e77537b 100644
--- a/cmd/list.go
+++ b/cmd/list.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"code.vegaprotocol.io/go-wallet/fsutil"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"code.vegaprotocol.io/go-wallet/wallet"
 
 	"github.com/spf13/cobra"
@@ -30,14 +30,20 @@ func init() {
 	rootCmd.AddCommand(listCmd)
 	listCmd.Flags().StringVarP(&listArgs.walletOwner, "name", "n", "", "Name of the wallet to use")
 	listCmd.Flags().StringVarP(&listArgs.passphrase, "passphrase", "p", "", "Passphrase to access the wallet")
-
 }
 
 func runList(cmd *cobra.Command, args []string) error {
-	if len(listArgs.walletOwner) <= 0 {
+	store, err := storev1.NewStore(rootArgs.rootPath)
+	if err != nil {
+		return err
+	}
+
+	handler := wallet.NewHandler(store)
+
+	if len(listArgs.walletOwner) == 0 {
 		return errors.New("wallet name is required")
 	}
-	if len(listArgs.passphrase) <= 0 {
+	if len(listArgs.passphrase) == 0 {
 		var err error
 		listArgs.passphrase, err = promptForPassphrase()
 		if err != nil {
@@ -45,16 +51,17 @@ func runList(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	if ok, err := fsutil.PathExists(rootArgs.rootPath); !ok {
-		return fmt.Errorf("invalid root directory path: %v", err)
+	err = handler.LoginWallet(listArgs.walletOwner, listArgs.passphrase)
+	if err != nil {
+		return fmt.Errorf("could not login to the wallet: %v", err)
 	}
 
-	wal, err := wallet.Read(rootArgs.rootPath, listArgs.walletOwner, listArgs.passphrase)
+	keys, err := handler.ListPublicKeys(listArgs.walletOwner)
 	if err != nil {
-		return fmt.Errorf("unable to decrypt wallet: %v", err)
+		return fmt.Errorf("could not list the public keys: %v", err)
 	}
 
-	buf, err := json.MarshalIndent(wal, " ", " ")
+	buf, err := json.MarshalIndent(keys, " ", " ")
 	if err != nil {
 		return fmt.Errorf("unable to marshal message: %v", err)
 	}
diff --git a/cmd/meta.go b/cmd/meta.go
index 930c27d..186dff2 100644
--- a/cmd/meta.go
+++ b/cmd/meta.go
@@ -3,9 +3,8 @@ package cmd
 import (
 	"errors"
 	"fmt"
-	"strings"
 
-	"code.vegaprotocol.io/go-wallet/fsutil"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"code.vegaprotocol.io/go-wallet/wallet"
 
 	"github.com/spf13/cobra"
@@ -33,60 +32,46 @@ func init() {
 	metaCmd.Flags().StringVarP(&metaArgs.walletOwner, "name", "n", "", "Name of the wallet to use")
 	metaCmd.Flags().StringVarP(&metaArgs.passphrase, "passphrase", "p", "", "Passphrase to access the wallet")
 	metaCmd.Flags().StringVarP(&metaArgs.pubkey, "pubkey", "k", "", "Public key to be used (hex)")
-	metaCmd.Flags().StringVarP(&metaArgs.metas, "metas", "m", "", `A list of metadata e.g: "primary:true;asset;BTC"`)
+	metaCmd.Flags().StringVarP(&metaArgs.metas, "metas", "m", "", `A list of metadata e.g: "primary:true;asset:BTC"`)
 }
 
 func runMeta(cmd *cobra.Command, args []string) error {
-	if len(metaArgs.walletOwner) <= 0 {
+	store, err := storev1.NewStore(rootArgs.rootPath)
+	if err != nil {
+		return err
+	}
+
+	handler := wallet.NewHandler(store)
+
+	if len(metaArgs.walletOwner) == 0 {
 		return errors.New("wallet name is required")
 	}
-	if len(metaArgs.passphrase) <= 0 {
+	if len(metaArgs.pubkey) == 0 {
+		return errors.New("pubkey is required")
+	}
+	if len(metaArgs.passphrase) == 0 {
 		var err error
 		metaArgs.passphrase, err = promptForPassphrase()
 		if err != nil {
 			return fmt.Errorf("could not get passphrase: %v", err)
 		}
 	}
-	if len(metaArgs.pubkey) <= 0 {
-		return errors.New("pubkey is required")
-	}
-	if ok, err := fsutil.PathExists(rootArgs.rootPath); !ok {
-		return fmt.Errorf("invalid root directory path: %v", err)
-	}
 
-	wal, err := wallet.Read(rootArgs.rootPath, metaArgs.walletOwner, metaArgs.passphrase)
+	metas, err := parseMeta(metaArgs.metas)
 	if err != nil {
-		return fmt.Errorf("unable to decrypt wallet: %v", err)
-	}
-
-	var kp *wallet.Keypair
-	for i, v := range wal.Keypairs {
-		if v.Pub == metaArgs.pubkey {
-			kp = &wal.Keypairs[i]
-		}
-	}
-	if kp == nil {
-		return fmt.Errorf("unknown public key: %v", metaArgs.pubkey)
+		return err
 	}
 
-	var meta []wallet.Meta
-	if len(metaArgs.metas) > 0 {
-		// expect ; separated metas
-		metasSplit := strings.Split(metaArgs.metas, ";")
-		for _, v := range metasSplit {
-			metaVal := strings.Split(v, ":")
-			if len(metaVal) != 2 {
-				return fmt.Errorf("invalid meta format")
-			}
-			meta = append(meta, wallet.Meta{Key: metaVal[0], Value: metaVal[1]})
-		}
+	err = handler.LoginWallet(metaArgs.walletOwner, metaArgs.passphrase)
+	if err != nil {
+		return fmt.Errorf("could not login to the wallet: %v", err)
 	}
 
-	kp.Meta = meta
-	_, err = wallet.Write(wal, rootArgs.rootPath, metaArgs.walletOwner, metaArgs.passphrase)
+	err = handler.UpdateMeta(metaArgs.walletOwner, metaArgs.pubkey, metaArgs.passphrase, metas)
 	if err != nil {
-		return err
+		return fmt.Errorf("could not update the meta: %v", err)
 	}
 
+	fmt.Printf("The meta have been updated.\n")
 	return nil
 }
diff --git a/cmd/root.go b/cmd/root.go
index e4b562d..deb34ae 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -7,8 +7,8 @@ import (
 	"code.vegaprotocol.io/go-wallet/fsutil"
 	"code.vegaprotocol.io/go-wallet/version"
 
-	"golang.org/x/crypto/ssh/terminal"
 	"github.com/spf13/cobra"
+	"golang.org/x/crypto/ssh/terminal"
 )
 
 var (
@@ -24,6 +24,8 @@ var (
 		Long:             `The Vega wallet`,
 		PersistentPreRun: checkVersion,
 	}
+
+
 )
 
 func checkVersion(cmd *cobra.Command, args []string) {
@@ -40,7 +42,6 @@ func checkVersion(cmd *cobra.Command, args []string) {
 }
 
 func Execute() {
-
 	if err := rootCmd.Execute(); err != nil {
 		fmt.Printf("%v\n", err)
 		os.Exit(1)
diff --git a/cmd/run.go b/cmd/run.go
index 9f0e3b3..7ab85cb 100644
--- a/cmd/run.go
+++ b/cmd/run.go
@@ -8,8 +8,8 @@ import (
 	"os/signal"
 	"syscall"
 
-	"code.vegaprotocol.io/go-wallet/wallet"
-
+	"code.vegaprotocol.io/go-wallet/service"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"github.com/skratchdot/open-golang/open"
 	"github.com/spf13/cobra"
 	"go.uber.org/zap"
@@ -37,20 +37,25 @@ func init() {
 }
 
 func runServiceRun(cmd *cobra.Command, args []string) error {
-	cfg, err := wallet.LoadConfig(rootArgs.rootPath)
+	log, err := zap.NewProduction()
 	if err != nil {
 		return err
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	store, err := storev1.NewStore(rootArgs.rootPath)
+	if err != nil {
+		return err
+	}
 
-	log, err := zap.NewProduction()
+	cfg, err := store.GetConfig()
 	if err != nil {
 		return err
 	}
 
-	srv, err := wallet.NewService(log, cfg, rootArgs.rootPath)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	srv, err := service.NewService(log, cfg, rootArgs.rootPath)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/sign.go b/cmd/sign.go
index 9889d11..5f3720e 100644
--- a/cmd/sign.go
+++ b/cmd/sign.go
@@ -5,10 +5,8 @@ import (
 	"errors"
 	"fmt"
 
-	"code.vegaprotocol.io/go-wallet/fsutil"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"code.vegaprotocol.io/go-wallet/wallet"
-	"code.vegaprotocol.io/go-wallet/wallet/crypto"
-
 	"github.com/spf13/cobra"
 )
 
@@ -38,9 +36,22 @@ func init() {
 }
 
 func runSign(cmd *cobra.Command, args []string) error {
-	if len(signArgs.walletOwner) <= 0 {
+	store, err := storev1.NewStore(rootArgs.rootPath)
+	if err != nil {
+		return err
+	}
+
+	handler := wallet.NewHandler(store)
+
+	if len(signArgs.walletOwner) == 0 {
 		return errors.New("wallet name is required")
 	}
+	if len(signArgs.pubkey) == 0 {
+		return errors.New("pubkey is required")
+	}
+	if len(signArgs.message) == 0 {
+		return errors.New("data is required")
+	}
 	if len(signArgs.passphrase) <= 0 {
 		var err error
 		signArgs.passphrase, err = promptForPassphrase()
@@ -48,49 +59,17 @@ func runSign(cmd *cobra.Command, args []string) error {
 			return fmt.Errorf("could not get passphrase: %v", err)
 		}
 	}
-	if len(signArgs.pubkey) <= 0 {
-		return errors.New("pubkey is required")
-	}
-	if len(signArgs.message) <= 0 {
-		return errors.New("data is required")
-	}
 
-	if ok, err := fsutil.PathExists(rootArgs.rootPath); !ok {
-		return fmt.Errorf("invalid root directory path: %v", err)
-	}
-
-	wal, err := wallet.Read(rootArgs.rootPath, signArgs.walletOwner, signArgs.passphrase)
+	err = handler.LoginWallet(signArgs.walletOwner, signArgs.passphrase)
 	if err != nil {
-		return fmt.Errorf("unable to decrypt wallet: %v", err)
+		return fmt.Errorf("could not login to the wallet: %v", err)
 	}
 
-	dataBuf, err := base64.StdEncoding.DecodeString(signArgs.message)
+	sig, err := handler.SignAny(signArgs.walletOwner, signArgs.message, signArgs.pubkey)
 	if err != nil {
-		return fmt.Errorf("invalid base64 encoded data: %v", err)
-	}
-
-	var kp *wallet.Keypair
-	for i, v := range wal.Keypairs {
-		if v.Pub == signArgs.pubkey {
-			kp = &wal.Keypairs[i]
-		}
-	}
-	if kp == nil {
-		return fmt.Errorf("unknown public key: %v", signArgs.pubkey)
-	}
-	if kp.Tainted {
-		return fmt.Errorf("key is tainted: %v", signArgs.pubkey)
+		return err
 	}
 
-	alg, err := crypto.NewSignatureAlgorithm(crypto.Ed25519)
-	if err != nil {
-		return fmt.Errorf("unable to instanciate signature algorithm: %v", err)
-	}
-	sig, err := wallet.Sign(alg, kp, dataBuf)
-	if err != nil {
-		return fmt.Errorf("unable to sign: %v", err)
-	}
 	fmt.Printf("%v\n", base64.StdEncoding.EncodeToString(sig))
-
 	return nil
 }
diff --git a/cmd/taint.go b/cmd/taint.go
index 9033e28..70eed56 100644
--- a/cmd/taint.go
+++ b/cmd/taint.go
@@ -4,7 +4,7 @@ import (
 	"errors"
 	"fmt"
 
-	"code.vegaprotocol.io/go-wallet/fsutil"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"code.vegaprotocol.io/go-wallet/wallet"
 	"github.com/spf13/cobra"
 )
@@ -32,46 +32,29 @@ func init() {
 }
 
 func runTaint(cmd *cobra.Command, args []string) error {
-	if len(taintArgs.walletOwner) <= 0 {
-		return errors.New("wallet name is required")
-	}
-	if len(taintArgs.passphrase) <= 0 {
-		var err error
-		taintArgs.passphrase, err = promptForPassphrase()
-		if err != nil {
-			return fmt.Errorf("could not get passphrase: %v", err)
-		}
+	store, err := storev1.NewStore(rootArgs.rootPath)
+	if err != nil {
+		return err
 	}
 
-	if ok, err := fsutil.PathExists(rootArgs.rootPath); !ok {
-		return fmt.Errorf("invalid root directory path: %v", err)
-	}
+	handler := wallet.NewHandler(store)
 
-	wal, err := wallet.Read(rootArgs.rootPath, taintArgs.walletOwner, taintArgs.passphrase)
-	if err != nil {
-		return fmt.Errorf("unable to decrypt wallet: %v", err)
+	if len(taintArgs.walletOwner) == 0 {
+		return errors.New("wallet name is required")
 	}
 
-	var kp *wallet.Keypair
-	for i, v := range wal.Keypairs {
-		if v.Pub == taintArgs.pubkey {
-			kp = &wal.Keypairs[i]
+	if len(taintArgs.passphrase) == 0 {
+		taintArgs.passphrase, err = promptForPassphrase()
+		if err != nil {
+			return fmt.Errorf("could not get passphrase: %v", err)
 		}
 	}
-	if kp == nil {
-		return fmt.Errorf("unknown public key: %v", taintArgs.pubkey)
-	}
 
-	if kp.Tainted {
-		return fmt.Errorf("key %v is already tainted", taintArgs.pubkey)
-	}
-
-	kp.Tainted = true
-
-	_, err = wallet.Write(wal, rootArgs.rootPath, taintArgs.walletOwner, taintArgs.passphrase)
+	err = handler.TaintKey(taintArgs.walletOwner, taintArgs.pubkey, taintArgs.passphrase)
 	if err != nil {
-		return err
+		return fmt.Errorf("could not taint the key: %v", err)
 	}
 
+	fmt.Printf("The key has been tainted.\n")
 	return nil
 }
diff --git a/cmd/verify.go b/cmd/verify.go
index 2cb4b97..a27600b 100644
--- a/cmd/verify.go
+++ b/cmd/verify.go
@@ -1,14 +1,11 @@
 package cmd
 
 import (
-	"encoding/base64"
 	"errors"
 	"fmt"
 
-	"code.vegaprotocol.io/go-wallet/fsutil"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
 	"code.vegaprotocol.io/go-wallet/wallet"
-	"code.vegaprotocol.io/go-wallet/wallet/crypto"
-
 	"github.com/spf13/cobra"
 )
 
@@ -40,62 +37,43 @@ func init() {
 }
 
 func runVerify(cmd *cobra.Command, args []string) error {
-	if len(verifyArgs.walletOwner) <= 0 {
-		return errors.New("wallet name is required")
+	store, err := storev1.NewStore(rootArgs.rootPath)
+	if err != nil {
+		return err
 	}
-	if len(verifyArgs.passphrase) <= 0 {
-		var err error
-		verifyArgs.passphrase, err = promptForPassphrase()
-		if err != nil {
-			return fmt.Errorf("could not get passphrase: %v", err)
-		}
+
+	handler := wallet.NewHandler(store)
+
+	if len(verifyArgs.walletOwner) == 0 {
+		return errors.New("wallet name is required")
 	}
-	if len(verifyArgs.pubkey) <= 0 {
+	if len(verifyArgs.pubkey) == 0 {
 		return errors.New("pubkey is required")
 	}
-	if len(verifyArgs.message) <= 0 {
+	if len(verifyArgs.message) == 0 {
 		return errors.New("message is required")
 	}
-	if len(verifyArgs.sig) <= 0 {
+	if len(verifyArgs.sig) == 0 {
 		return errors.New("data is required")
 	}
-
-	if ok, err := fsutil.PathExists(rootArgs.rootPath); !ok {
-		return fmt.Errorf("invalid root directory path: %v", err)
+	if len(verifyArgs.passphrase) == 0 {
+		var err error
+		verifyArgs.passphrase, err = promptForPassphrase()
+		if err != nil {
+			return fmt.Errorf("could not get passphrase: %v", err)
+		}
 	}
 
-	wal, err := wallet.Read(rootArgs.rootPath, verifyArgs.walletOwner, verifyArgs.passphrase)
+	err = handler.LoginWallet(verifyArgs.walletOwner, verifyArgs.passphrase)
 	if err != nil {
-		return fmt.Errorf("unable to decrypt wallet: %v", err)
+		return fmt.Errorf("could not login to the wallet: %v", err)
 	}
 
-	dataBuf, err := base64.StdEncoding.DecodeString(verifyArgs.message)
+	verified, err := handler.VerifyAny(verifyArgs.walletOwner, verifyArgs.message, verifyArgs.sig, verifyArgs.pubkey)
 	if err != nil {
-		return fmt.Errorf("invalid base64 encoded data: %v", err)
-	}
-	sigBuf, err := base64.StdEncoding.DecodeString(verifyArgs.sig)
-	if err != nil {
-		return fmt.Errorf("invalid base64 encoded data: %v", err)
+		return fmt.Errorf("could not verify the message: %v", err)
 	}
 
-	var kp *wallet.Keypair
-	for i, v := range wal.Keypairs {
-		if v.Pub == verifyArgs.pubkey {
-			kp = &wal.Keypairs[i]
-		}
-	}
-	if kp == nil {
-		return fmt.Errorf("unknown public key: %v", verifyArgs.pubkey)
-	}
-
-	alg, err := crypto.NewSignatureAlgorithm(crypto.Ed25519)
-	if err != nil {
-		return fmt.Errorf("unable to instanciate signature algorithm: %v", err)
-	}
-	verified, err := wallet.Verify(alg, kp, dataBuf, sigBuf)
-	if err != nil {
-		return fmt.Errorf("unable to verify: %v", err)
-	}
 	fmt.Printf("%v\n", verified)
 
 	return nil
diff --git a/config/config.go b/config/config.go
new file mode 100644
index 0000000..9b41abe
--- /dev/null
+++ b/config/config.go
@@ -0,0 +1,105 @@
+package config
+
+import (
+	"time"
+
+	"code.vegaprotocol.io/go-wallet/config/encoding"
+	"code.vegaprotocol.io/go-wallet/wallet"
+	"go.uber.org/zap"
+)
+
+const (
+	//  7 days, needs to be in seconds for the token
+	tokenExpiry = time.Hour * 24 * 7
+)
+
+//go:generate go run github.com/golang/mock/mockgen -destination mocks/store_mock.go -package mocks code.vegaprotocol.io/go-wallet/config Store
+type Store interface {
+	SaveConfig(*Config, bool) error
+	SaveRSAKeys(*wallet.RSAKeys, bool) error
+}
+
+type Config struct {
+	Level       encoding.LogLevel
+	TokenExpiry encoding.Duration
+	Port        int
+	Host        string
+	Nodes       NodesConfig
+	RsaKey      string
+	Console     ConsoleConfig
+}
+
+type ConsoleConfig struct {
+	URL       string
+	LocalPort int
+}
+
+type NodesConfig struct {
+	Hosts   []string
+	Retries uint64
+}
+
+func GenerateConfig(log *zap.Logger, store Store, overwrite, genRsaKey bool) error {
+	config := NewDefaultConfig()
+	err := store.SaveConfig(&config, overwrite)
+	if err != nil {
+		return err
+	}
+
+	log.Info("wallet service configuration generated successfully")
+
+	if genRsaKey {
+		keys, err := wallet.GenerateRSAKeys()
+		if err != nil {
+			return err
+		}
+		if err := store.SaveRSAKeys(keys, overwrite); err != nil {
+			return err
+		}
+
+		log.Info("wallet RSA keys generated successfully")
+	}
+
+	return nil
+}
+
+// NewDefaultConfig creates an instance of the package specific configuration,
+// given a pointer to a logger instance to be used for logging within the
+// package.
+func NewDefaultConfig() Config {
+	return Config{
+		Level:       encoding.LogLevel{Level: zap.InfoLevel},
+		TokenExpiry: encoding.Duration{Duration: tokenExpiry},
+		Nodes: NodesConfig{
+			Hosts: []string{
+				"n01.testnet.vega.xyz:3002",
+				"n02.testnet.vega.xyz:3002",
+				"n03.testnet.vega.xyz:3002",
+				"n04.testnet.vega.xyz:3002",
+				"n05.testnet.vega.xyz:3002",
+				"n06.testnet.vega.xyz:3002",
+				"n07.testnet.vega.xyz:3002",
+				"n08.testnet.vega.xyz:3002",
+				"n09.testnet.vega.xyz:3002",
+				"n10.testnet.vega.xyz:3002",
+				"n11.testnet.vega.xyz:3002",
+				"n12.testnet.vega.xyz:3002",
+				"n13.testnet.vega.xyz:3002",
+				"n14.testnet.vega.xyz:3002",
+				"n15.testnet.vega.xyz:3002",
+				"n16.testnet.vega.xyz:3002",
+				"n17.testnet.vega.xyz:3002",
+				"n18.testnet.vega.xyz:3002",
+				"n19.testnet.vega.xyz:3002",
+				"n20.testnet.vega.xyz:3002",
+			},
+			Retries: 5,
+		},
+		Host: "127.0.0.1",
+		Port: 1789,
+		Console: ConsoleConfig{
+			URL:       "console.fairground.wtf",
+			LocalPort: 1847,
+		},
+	}
+}
diff --git a/config/encoding/encoding.go b/config/encoding/encoding.go
index f98ba9f..12f48a8 100644
--- a/config/encoding/encoding.go
+++ b/config/encoding/encoding.go
@@ -24,7 +24,7 @@ func (d *Duration) UnmarshalText(text []byte) error {
 	return err
 }
 
-// MarshalText marshal a duraton into bytes
+// MarshalText marshal a duration into bytes
 func (d Duration) MarshalText() ([]byte, error) {
 	return []byte(d.String()), nil
 }
diff --git a/config/mocks/store_mock.go b/config/mocks/store_mock.go
new file mode 100644
index 0000000..3abd967
--- /dev/null
+++ b/config/mocks/store_mock.go
@@ -0,0 +1,63 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: code.vegaprotocol.io/go-wallet/config (interfaces: Store)
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	config "code.vegaprotocol.io/go-wallet/config"
+	wallet "code.vegaprotocol.io/go-wallet/wallet"
+	gomock "github.com/golang/mock/gomock"
+	reflect "reflect"
+)
+
+// MockStore is a mock of Store interface
+type MockStore struct {
+	ctrl     *gomock.Controller
+	recorder *MockStoreMockRecorder
+}
+
+// MockStoreMockRecorder is the mock recorder for MockStore
+type MockStoreMockRecorder struct {
+	mock *MockStore
+}
+
+// NewMockStore creates a new mock instance
+func NewMockStore(ctrl *gomock.Controller) *MockStore {
+	mock := &MockStore{ctrl: ctrl}
+	mock.recorder = &MockStoreMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use
+func (m *MockStore) EXPECT() *MockStoreMockRecorder {
+	return m.recorder
+}
+
+// SaveConfig mocks base method
+func (m *MockStore) SaveConfig(arg0 *config.Config, arg1 bool) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveConfig", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveConfig indicates an expected call of SaveConfig
+func (mr *MockStoreMockRecorder) SaveConfig(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveConfig", reflect.TypeOf((*MockStore)(nil).SaveConfig), arg0, arg1)
+}
+
+// SaveRSAKeys mocks base method
+func (m *MockStore) SaveRSAKeys(arg0 *wallet.RSAKeys, arg1 bool) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveRSAKeys", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveRSAKeys indicates an expected call of SaveRSAKeys
+func (mr *MockStoreMockRecorder) SaveRSAKeys(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveRSAKeys", reflect.TypeOf((*MockStore)(nil).SaveRSAKeys), arg0, arg1)
+}
diff --git a/fsutil/fsutil.go b/fsutil/fsutil.go
index 333c8ad..253155e 100644
--- a/fsutil/fsutil.go
+++ b/fsutil/fsutil.go
@@ -58,7 +58,7 @@ func EnsureDir(path string) error {
 	_, err := os.Stat(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return os.Mkdir(path, dirPerms)
+			return os.MkdirAll(path, dirPerms)
 		}
 		return err
 	}
diff --git a/wallet/README.md b/service/README.md
similarity index 98%
rename from wallet/README.md
rename to service/README.md
index 9305437..f3a0922 100644
--- a/wallet/README.md
+++ b/service/README.md
@@ -6,8 +6,6 @@ This package provides the basic cryptography to sign vega transactions, and a ba
 A wallet takes the form of a file saved on the file system and is encrypted using the passphrase chosen by the user.
 A wallet is composed of a list of key pairs (Ed25519) used to sign transactions for the user of a wallet.
 
-To read more about authentication & signing in Vega, see [Authentication & Signing](../design/authentication-and-signing.md)
-
 ## Generate configuration
 
 The package provides a way to generate the configuration of the service before starting it, it can be used through the vega command line like so:
diff --git a/wallet/auth.go b/service/auth.go
similarity index 78%
rename from wallet/auth.go
rename to service/auth.go
index 9159e3a..1f7cfb2 100644
--- a/wallet/auth.go
+++ b/service/auth.go
@@ -1,16 +1,17 @@
-package wallet
+package service
 
 import (
 	"crypto/rsa"
 	"encoding/hex"
 	"errors"
+	"fmt"
 	"net/http"
 	"strings"
 	"sync"
 	"time"
 
 	"code.vegaprotocol.io/go-wallet/crypto"
-
+	"code.vegaprotocol.io/go-wallet/wallet"
 	"github.com/dgrijalva/jwt-go/v4"
 	"github.com/julienschmidt/httprouter"
 	"go.uber.org/zap"
@@ -20,6 +21,11 @@ var (
 	ErrSessionNotFound = errors.New("session not found")
 )
 
+//go:generate go run github.com/golang/mock/mockgen -destination mocks/rsa_store_mock.go -package mocks code.vegaprotocol.io/go-wallet/service RSAStore
+type RSAStore interface {
+	GetRsaKeys() (*wallet.RSAKeys, error)
+}
+
 type auth struct {
 	log *zap.Logger
 	// sessionID -> wallet name
@@ -31,19 +37,18 @@ type auth struct {
 	mu sync.Mutex
 }
 
-func NewAuth(log *zap.Logger, rootPath string, tokenExpiry time.Duration) (*auth, error) {
-	// get rsa keys
-	pubBuf, privBuf, err := readRsaKeys(rootPath)
+func NewAuth(log *zap.Logger, cfgStore RSAStore, tokenExpiry time.Duration) (*auth, error) {
+	keys, err := cfgStore.GetRsaKeys()
 	if err != nil {
 		return nil, err
 	}
-	priv, err := jwt.ParseRSAPrivateKeyFromPEM(privBuf)
+	priv, err := jwt.ParseRSAPrivateKeyFromPEM(keys.Priv)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("couldn't parse private RSA key: %v", err)
 	}
-	pub, err := jwt.ParseRSAPublicKeyFromPEM(pubBuf)
+	pub, err := jwt.ParseRSAPublicKeyFromPEM(keys.Pub)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("couldn't parse public RSA key: %v", err)
 	}
 
 	return &auth{
@@ -61,17 +66,17 @@ type Claims struct {
 	Wallet  string
 }
 
-func (a *auth) NewSession(walletname string) (string, error) {
+func (a *auth) NewSession(name string) (string, error) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
 	expiresAt := time.Now().Add(a.tokenExpiry)
 
 	session := genSession()
-	// Create the Claims
+
 	claims := &Claims{
 		Session: session,
-		Wallet:  walletname,
+		Wallet:  name,
 		StandardClaims: jwt.StandardClaims{
 			// these are seconds
 			ExpiresAt: jwt.NewTime((float64)(expiresAt.Unix())),
@@ -86,8 +91,7 @@ func (a *auth) NewSession(walletname string) (string, error) {
 		return "", err
 	}
 
-	// all good up to now, insert the new session
-	a.sessions[session] = walletname
+	a.sessions[session] = name
 	return ss, nil
 }
 
@@ -96,18 +100,17 @@ func (a *auth) VerifyToken(token string) (string, error) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
-	// first parse the token
 	claims, err := a.parseToken(token)
 	if err != nil {
 		return "", err
 	}
 
-	wallet, ok := a.sessions[claims.Session]
+	w, ok := a.sessions[claims.Session]
 	if !ok {
 		return "", ErrSessionNotFound
 	}
 
-	return wallet, nil
+	return w, nil
 }
 
 func (a *auth) Revoke(token string) error {
@@ -119,7 +122,6 @@ func (a *auth) Revoke(token string) error {
 		return err
 	}
 
-	// extract session from the token
 	_, ok := a.sessions[claims.Session]
 	if !ok {
 		return ErrSessionNotFound
@@ -147,17 +149,14 @@ func ExtractToken(f func(string, http.ResponseWriter, *http.Request, httprouter.
 	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 		token := r.Header.Get("Authorization")
 		if len(token) <= 0 {
-			// invalid token, return an error here
 			writeError(w, ErrInvalidOrMissingToken, http.StatusBadRequest)
 			return
 		}
 		splitToken := strings.Split(token, "Bearer")
 		if len(splitToken) != 2 || len(splitToken[1]) <= 0 {
-			// invalid token, return an error here
 			writeError(w, ErrInvalidOrMissingToken, http.StatusBadRequest)
 			return
 		}
-		// then call the function
 		f(strings.TrimSpace(splitToken[1]), w, r, ps)
 	}
 }
diff --git a/service/error.go b/service/error.go
new file mode 100644
index 0000000..8072929
--- /dev/null
+++ b/service/error.go
@@ -0,0 +1,39 @@
+package service
+
+import (
+	"errors"
+
+	"code.vegaprotocol.io/go-wallet/commands"
+)
+
+var (
+	ErrInvalidOrMissingToken  = newErrorResponse("invalid or missing token")
+	ErrCouldNotReadRequest = errors.New("could not read request")
+	ErrCouldNotGetBlockHeight = errors.New("could not get last block height")
+)
+
+type ErrorsResponse struct {
+	Errors commands.Errors `json:"errors"`
+}
+
+type ErrorResponse struct {
+	ErrorStr string   `json:"error"`
+	Details  []string `json:"details"`
+}
+
+func (e ErrorResponse) Error() string {
+	return e.ErrorStr
+}
+
+func newErrorResponse(e string) ErrorResponse {
+	return ErrorResponse{
+		ErrorStr: e,
+	}
+}
+
+func newErrorWithDetails(e string, details []string) ErrorResponse {
+	return ErrorResponse{
+		ErrorStr: e,
+		Details:  details,
+	}
+}
diff --git a/wallet/mocks/auth_mock.go b/service/mocks/auth_mock.go
similarity index 96%
rename from wallet/mocks/auth_mock.go
rename to service/mocks/auth_mock.go
index 0184bd1..e21b9f9 100644
--- a/wallet/mocks/auth_mock.go
+++ b/service/mocks/auth_mock.go
@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: code.vegaprotocol.io/go-wallet/wallet (interfaces: Auth)
+// Source: code.vegaprotocol.io/go-wallet/service (interfaces: Auth)
 
 // Package mocks is a generated GoMock package.
 package mocks
diff --git a/wallet/mocks/node_forward_mock.go b/service/mocks/node_forward_mock.go
similarity index 97%
rename from wallet/mocks/node_forward_mock.go
rename to service/mocks/node_forward_mock.go
index a97d937..7c639c2 100644
--- a/wallet/mocks/node_forward_mock.go
+++ b/service/mocks/node_forward_mock.go
@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: code.vegaprotocol.io/go-wallet/wallet (interfaces: NodeForward)
+// Source: code.vegaprotocol.io/go-wallet/service (interfaces: NodeForward)
 
 // Package mocks is a generated GoMock package.
 package mocks
diff --git a/service/mocks/rsa_store_mock.go b/service/mocks/rsa_store_mock.go
new file mode 100644
index 0000000..e535b3d
--- /dev/null
+++ b/service/mocks/rsa_store_mock.go
@@ -0,0 +1,49 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: code.vegaprotocol.io/go-wallet/service (interfaces: RSAStore)
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	wallet "code.vegaprotocol.io/go-wallet/wallet"
+	gomock "github.com/golang/mock/gomock"
+	reflect "reflect"
+)
+
+// MockRSAStore is a mock of RSAStore interface
+type MockRSAStore struct {
+	ctrl     *gomock.Controller
+	recorder *MockRSAStoreMockRecorder
+}
+
+// MockRSAStoreMockRecorder is the mock recorder for MockRSAStore
+type MockRSAStoreMockRecorder struct {
+	mock *MockRSAStore
+}
+
+// NewMockRSAStore creates a new mock instance
+func NewMockRSAStore(ctrl *gomock.Controller) *MockRSAStore {
+	mock := &MockRSAStore{ctrl: ctrl}
+	mock.recorder = &MockRSAStoreMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use
+func (m *MockRSAStore) EXPECT() *MockRSAStoreMockRecorder {
+	return m.recorder
+}
+
+// GetRsaKeys mocks base method
+func (m *MockRSAStore) GetRsaKeys() (*wallet.RSAKeys, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetRsaKeys")
+	ret0, _ := ret[0].(*wallet.RSAKeys)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetRsaKeys indicates an expected call of GetRsaKeys
+func (mr *MockRSAStoreMockRecorder) GetRsaKeys() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetRsaKeys", reflect.TypeOf((*MockRSAStore)(nil).GetRsaKeys))
+}
diff --git a/wallet/mocks/wallet_handler_mock.go b/service/mocks/wallet_handler_mock.go
similarity index 75%
rename from wallet/mocks/wallet_handler_mock.go
rename to service/mocks/wallet_handler_mock.go
index d7f1650..716ba98 100644
--- a/wallet/mocks/wallet_handler_mock.go
+++ b/service/mocks/wallet_handler_mock.go
@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: code.vegaprotocol.io/go-wallet/wallet (interfaces: WalletHandler)
+// Source: code.vegaprotocol.io/go-wallet/service (interfaces: WalletHandler)
 
 // Package mocks is a generated GoMock package.
 package mocks
@@ -36,12 +36,11 @@ func (m *MockWalletHandler) EXPECT() *MockWalletHandlerMockRecorder {
 }
 
 // CreateWallet mocks base method
-func (m *MockWalletHandler) CreateWallet(arg0, arg1 string) (string, error) {
+func (m *MockWalletHandler) CreateWallet(arg0, arg1 string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "CreateWallet", arg0, arg1)
-	ret0, _ := ret[0].(string)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
+	ret0, _ := ret[0].(error)
+	return ret0
 }
 
 // CreateWallet indicates an expected call of CreateWallet
@@ -50,26 +49,11 @@ func (mr *MockWalletHandlerMockRecorder) CreateWallet(arg0, arg1 interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateWallet", reflect.TypeOf((*MockWalletHandler)(nil).CreateWallet), arg0, arg1)
 }
 
-// GenerateKeypair mocks base method
-func (m *MockWalletHandler) GenerateKeypair(arg0, arg1 string) (string, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GenerateKeypair", arg0, arg1)
-	ret0, _ := ret[0].(string)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GenerateKeypair indicates an expected call of GenerateKeypair
-func (mr *MockWalletHandlerMockRecorder) GenerateKeypair(arg0, arg1 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GenerateKeypair", reflect.TypeOf((*MockWalletHandler)(nil).GenerateKeypair), arg0, arg1)
-}
-
 // GetPublicKey mocks base method
-func (m *MockWalletHandler) GetPublicKey(arg0, arg1 string) (*wallet.Keypair, error) {
+func (m *MockWalletHandler) GetPublicKey(arg0, arg1 string) (*wallet.PublicKey, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetPublicKey", arg0, arg1)
-	ret0, _ := ret[0].(*wallet.Keypair)
+	ret0, _ := ret[0].(*wallet.PublicKey)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
@@ -80,21 +64,6 @@ func (mr *MockWalletHandlerMockRecorder) GetPublicKey(arg0, arg1 interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPublicKey", reflect.TypeOf((*MockWalletHandler)(nil).GetPublicKey), arg0, arg1)
 }
 
-// GetWalletName mocks base method
-func (m *MockWalletHandler) GetWalletName(arg0 string) (string, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetWalletName", arg0)
-	ret0, _ := ret[0].(string)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetWalletName indicates an expected call of GetWalletName
-func (mr *MockWalletHandlerMockRecorder) GetWalletName(arg0 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWalletName", reflect.TypeOf((*MockWalletHandler)(nil).GetWalletName), arg0)
-}
-
 // GetWalletPath mocks base method
 func (m *MockWalletHandler) GetWalletPath(arg0 string) (string, error) {
 	m.ctrl.T.Helper()
@@ -111,10 +80,10 @@ func (mr *MockWalletHandlerMockRecorder) GetWalletPath(arg0 interface{}) *gomock
 }
 
 // ListPublicKeys mocks base method
-func (m *MockWalletHandler) ListPublicKeys(arg0 string) ([]wallet.Keypair, error) {
+func (m *MockWalletHandler) ListPublicKeys(arg0 string) ([]wallet.PublicKey, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ListPublicKeys", arg0)
-	ret0, _ := ret[0].([]wallet.Keypair)
+	ret0, _ := ret[0].([]wallet.PublicKey)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
@@ -126,12 +95,11 @@ func (mr *MockWalletHandlerMockRecorder) ListPublicKeys(arg0 interface{}) *gomoc
 }
 
 // LoginWallet mocks base method
-func (m *MockWalletHandler) LoginWallet(arg0, arg1 string) (string, error) {
+func (m *MockWalletHandler) LoginWallet(arg0, arg1 string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "LoginWallet", arg0, arg1)
-	ret0, _ := ret[0].(string)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
+	ret0, _ := ret[0].(error)
+	return ret0
 }
 
 // LoginWallet indicates an expected call of LoginWallet
@@ -140,18 +108,19 @@ func (mr *MockWalletHandlerMockRecorder) LoginWallet(arg0, arg1 interface{}) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LoginWallet", reflect.TypeOf((*MockWalletHandler)(nil).LoginWallet), arg0, arg1)
 }
 
-// RevokeToken mocks base method
-func (m *MockWalletHandler) RevokeToken(arg0 string) error {
+// SecureGenerateKeyPair mocks base method
+func (m *MockWalletHandler) SecureGenerateKeyPair(arg0, arg1 string) (string, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RevokeToken", arg0)
-	ret0, _ := ret[0].(error)
-	return ret0
+	ret := m.ctrl.Call(m, "SecureGenerateKeyPair", arg0, arg1)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
 }
 
-// RevokeToken indicates an expected call of RevokeToken
-func (mr *MockWalletHandlerMockRecorder) RevokeToken(arg0 interface{}) *gomock.Call {
+// SecureGenerateKeyPair indicates an expected call of SecureGenerateKeyPair
+func (mr *MockWalletHandlerMockRecorder) SecureGenerateKeyPair(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeToken", reflect.TypeOf((*MockWalletHandler)(nil).RevokeToken), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SecureGenerateKeyPair", reflect.TypeOf((*MockWalletHandler)(nil).SecureGenerateKeyPair), arg0, arg1)
 }
 
 // SignAny mocks base method
@@ -185,7 +154,7 @@ func (mr *MockWalletHandlerMockRecorder) SignTx(arg0, arg1, arg2, arg3 interface
 }
 
 // SignTxV2 mocks base method
-func (m *MockWalletHandler) SignTxV2(arg0 string, arg1 v10.SubmitTransactionRequest, arg2 uint64) (*v1.Transaction, error) {
+func (m *MockWalletHandler) SignTxV2(arg0 string, arg1 *v10.SubmitTransactionRequest, arg2 uint64) (*v1.Transaction, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "SignTxV2", arg0, arg1, arg2)
 	ret0, _ := ret[0].(*v1.Transaction)
diff --git a/wallet/node_forward.go b/service/node_forward.go
similarity index 93%
rename from wallet/node_forward.go
rename to service/node_forward.go
index d136699..d5fd782 100644
--- a/wallet/node_forward.go
+++ b/service/node_forward.go
@@ -1,4 +1,4 @@
-package wallet
+package service
 
 import (
 	"context"
@@ -6,6 +6,8 @@ import (
 	"sync/atomic"
 	"time"
 
+	"code.vegaprotocol.io/go-wallet/config"
+	"code.vegaprotocol.io/go-wallet/wallet"
 	"github.com/cenkalti/backoff/v4"
 	vproto "github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto"
 	"github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/api"
@@ -17,14 +19,14 @@ import (
 
 type nodeForward struct {
 	log      *zap.Logger
-	nodeCfgs NodesConfig
+	nodeCfgs config.NodesConfig
 	clts     []api.TradingServiceClient
 	cltDatas []api.TradingDataServiceClient
 	conns    []*grpc.ClientConn
 	next     uint64
 }
 
-func NewNodeForward(log *zap.Logger, nodeConfigs NodesConfig) (*nodeForward, error) {
+func newNodeForward(log *zap.Logger, nodeConfigs config.NodesConfig) (*nodeForward, error) {
 	if len(nodeConfigs.Hosts) <= 0 {
 		return nil, errors.New("no node specified for node forwarding")
 	}
@@ -108,7 +110,7 @@ func (n *nodeForward) LastBlockHeight(ctx context.Context) (uint64, error) {
 	return height, err
 }
 
-func (n *nodeForward) Send(ctx context.Context, tx *SignedBundle, ty api.SubmitTransactionRequest_Type) error {
+func (n *nodeForward) Send(ctx context.Context, tx *wallet.SignedBundle, ty api.SubmitTransactionRequest_Type) error {
 	req := api.SubmitTransactionRequest{
 		Tx:   tx.IntoProto(),
 		Type: ty,
diff --git a/wallet/service.go b/service/service.go
similarity index 54%
rename from wallet/service.go
rename to service/service.go
index bccbcd7..12a8718 100644
--- a/wallet/service.go
+++ b/service/service.go
@@ -1,16 +1,18 @@
-package wallet
+package service
 
 import (
 	"context"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io/ioutil"
 	"net/http"
 
 	"code.vegaprotocol.io/go-wallet/commands"
+	"code.vegaprotocol.io/go-wallet/config"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
+	"code.vegaprotocol.io/go-wallet/wallet"
 	typespb "github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto"
 	"github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/api"
 	commandspb "github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/commands/v1"
@@ -27,10 +29,11 @@ import (
 type Service struct {
 	*httprouter.Router
 
-	cfg         *Config
+	cfg         *config.Config
 	log         *zap.Logger
 	s           *http.Server
 	handler     WalletHandler
+	auth        Auth
 	nodeForward NodeForward
 }
 
@@ -40,15 +43,109 @@ type CreateLoginWalletRequest struct {
 	Passphrase string `json:"passphrase"`
 }
 
-// PassphraseRequest describes the request for TaintKey.
-type PassphraseRequest struct {
-	Passphrase string `json:"passphrase"`
+func ParseCreateLoginWalletRequest(r *http.Request) (*CreateLoginWalletRequest, commands.Errors) {
+	errs := commands.NewErrors()
+
+	req := &CreateLoginWalletRequest{}
+	if err := unmarshalBody(r, &req); err != nil {
+		return nil, errs.FinalAdd(err)
+	}
+
+	if len(req.Wallet) == 0 {
+		errs.AddForProperty("wallet", commands.ErrIsRequired)
+	}
+
+	if len(req.Passphrase) == 0 {
+		errs.AddForProperty("passphrase", commands.ErrIsRequired)
+	}
+
+	if !errs.Empty() {
+		return nil, errs
+	}
+
+	return req, errs
 }
 
-// PassphraseMetaRequest describes the request for GenerateKeypair, UpdateMeta.
-type PassphraseMetaRequest struct {
+// TaintKeyRequest describes the request for TaintKey.
+type TaintKeyRequest struct {
 	Passphrase string `json:"passphrase"`
-	Meta       []Meta `json:"meta"`
+}
+
+func ParseTaintKeyRequest(r *http.Request, keyID string) (*TaintKeyRequest, commands.Errors) {
+	errs := commands.NewErrors()
+
+	if len(keyID) == 0 {
+		errs.AddForProperty("keyid", commands.ErrIsRequired)
+	}
+
+	req := &TaintKeyRequest{}
+	if err := unmarshalBody(r, &req); err != nil {
+		return nil, errs.FinalAdd(err)
+	}
+
+	if len(req.Passphrase) == 0 {
+		errs.AddForProperty("passphrase", commands.ErrIsRequired)
+	}
+
+	if !errs.Empty() {
+		return nil, errs
+	}
+
+	return req, errs
+}
+
+// GenKeyPairRequest describes the request for GenerateKeypair
+type GenKeyPairRequest struct {
+	Passphrase string        `json:"passphrase"`
+	Meta       []wallet.Meta `json:"meta"`
+}
+
+func ParseGenKeyPairRequest(r *http.Request) (*GenKeyPairRequest, commands.Errors) {
+	errs := commands.NewErrors()
+
+	req := &GenKeyPairRequest{}
+	if err := unmarshalBody(r, &req); err != nil {
+		return nil, errs.FinalAdd(err)
+	}
+
+	if len(req.Passphrase) == 0 {
+		errs.AddForProperty("passphrase", commands.ErrIsRequired)
+	}
+
+	if !errs.Empty() {
+		return nil, errs
+	}
+
+	return req, errs
+}
+
+// UpdateMetaRequest describes the request for UpdateMeta.
+type UpdateMetaRequest struct {
+	Passphrase string        `json:"passphrase"`
+	Meta       []wallet.Meta `json:"meta"`
+}
+
+func ParseUpdateMetaRequest(r *http.Request, keyID string) (*UpdateMetaRequest, commands.Errors) {
+	errs := commands.NewErrors()
+
+	if len(keyID) == 0 {
+		errs.AddForProperty("keyid", commands.ErrIsRequired)
+	}
+
+	req := &UpdateMetaRequest{}
+	if err := unmarshalBody(r, &req); err != nil {
+		return nil, errs.FinalAdd(err)
+	}
+
+	if len(req.Passphrase) == 0 {
+		errs.AddForProperty("passphrase", commands.ErrIsRequired)
+	}
+
+	if !errs.Empty() {
+		return nil, errs
+	}
+
+	return req, errs
 }
 
 // SignTxRequest describes the request for SignTx.
@@ -64,21 +161,59 @@ type SignAnyRequest struct {
 	PubKey    string `json:"pubKey"`
 }
 
+func ParseSignAnyRequest(r *http.Request) (*SignAnyRequest, commands.Errors) {
+	errs := commands.NewErrors()
+
+	req := &SignAnyRequest{}
+	if err := unmarshalBody(r, &req); err != nil {
+		return nil, errs.FinalAdd(err)
+	}
+
+	if len(req.InputData) == 0 {
+		errs.AddForProperty("input_data", commands.ErrIsRequired)
+	}
+
+	if len(req.PubKey) == 0 {
+		errs.AddForProperty("pub_key", commands.ErrIsRequired)
+	}
+
+	if !errs.Empty() {
+		return nil, errs
+	}
+
+	return req, errs
+}
+
+func ParseSubmitTransactionRequest(r *http.Request) (*walletpb.SubmitTransactionRequest, commands.Errors) {
+	errs := commands.NewErrors()
+
+	req := &walletpb.SubmitTransactionRequest{}
+	if err := jsonpb.Unmarshal(r.Body, req); err != nil {
+		return nil, errs.FinalAdd(err)
+	}
+
+	if errs = wallet.CheckSubmitTransactionRequest(req); !errs.Empty() {
+		return nil, errs
+	}
+
+	return req, nil
+}
+
 // KeyResponse describes the response to a request that returns a single key.
 type KeyResponse struct {
-	Key Keypair `json:"key"`
+	Key wallet.PublicKey `json:"key"`
 }
 
 // KeysResponse describes the response to a request that returns a list of keys.
 type KeysResponse struct {
-	Keys []Keypair `json:"keys"`
+	Keys []wallet.PublicKey `json:"keys"`
 }
 
 // SignTxResponse describes the response for SignTx.
 type SignTxResponse struct {
-	SignedTx     SignedBundle `json:"signedTx"`
-	HexBundle    string       `json:"hexBundle"`
-	Base64Bundle string       `json:"base64Bundle"`
+	SignedTx     wallet.SignedBundle `json:"signedTx"`
+	HexBundle    string              `json:"hexBundle"`
+	Base64Bundle string              `json:"base64Bundle"`
 }
 
 // SignAnyResponse describes the response for SignAny.
@@ -98,57 +233,64 @@ type TokenResponse struct {
 }
 
 // WalletHandler ...
-//go:generate go run github.com/golang/mock/mockgen -destination mocks/wallet_handler_mock.go -package mocks code.vegaprotocol.io/go-wallet/wallet WalletHandler
+//go:generate go run github.com/golang/mock/mockgen -destination mocks/wallet_handler_mock.go -package mocks code.vegaprotocol.io/go-wallet/service WalletHandler
 type WalletHandler interface {
-	CreateWallet(name, passphrase string) (string, error)
-	LoginWallet(name, passphrase string) (string, error)
-	RevokeToken(token string) error
-	GenerateKeypair(token, passphrase string) (string, error)
-	GetPublicKey(token, pubKey string) (*Keypair, error)
-	GetWalletName(token string) (string, error)
-	ListPublicKeys(token string) ([]Keypair, error)
-	SignTx(token, tx, pubKey string, height uint64) (SignedBundle, error)
-	SignTxV2(token string, req walletpb.SubmitTransactionRequest, height uint64) (*commandspb.Transaction, error)
-	SignAny(token, inputData, pubKey string) ([]byte, error)
-	TaintKey(token, pubKey, passphrase string) error
-	UpdateMeta(token, pubKey, passphrase string, meta []Meta) error
-	GetWalletPath(token string) (string, error)
+	CreateWallet(name, passphrase string) error
+	LoginWallet(name, passphrase string) error
+	SecureGenerateKeyPair(name, passphrase string) (string, error)
+	GetPublicKey(name, pubKey string) (*wallet.PublicKey, error)
+	ListPublicKeys(name string) ([]wallet.PublicKey, error)
+	SignTx(name, tx, pubKey string, height uint64) (wallet.SignedBundle, error)
+	SignTxV2(name string, req *walletpb.SubmitTransactionRequest, height uint64) (*commandspb.Transaction, error)
+	SignAny(name, inputData, pubKey string) ([]byte, error)
+	TaintKey(name, pubKey, passphrase string) error
+	UpdateMeta(name, pubKey, passphrase string, meta []wallet.Meta) error
+	GetWalletPath(name string) (string, error)
+}
+
+// Auth ...
+//go:generate go run github.com/golang/mock/mockgen -destination mocks/auth_mock.go -package mocks code.vegaprotocol.io/go-wallet/service Auth
+type Auth interface {
+	NewSession(name string) (string, error)
+	VerifyToken(token string) (string, error)
+	Revoke(token string) error
 }
 
 // NodeForward ...
-//go:generate go run github.com/golang/mock/mockgen -destination mocks/node_forward_mock.go -package mocks code.vegaprotocol.io/go-wallet/wallet NodeForward
+//go:generate go run github.com/golang/mock/mockgen -destination mocks/node_forward_mock.go -package mocks code.vegaprotocol.io/go-wallet/service NodeForward
 type NodeForward interface {
-	Send(context.Context, *SignedBundle, api.SubmitTransactionRequest_Type) error
+	Send(context.Context, *wallet.SignedBundle, api.SubmitTransactionRequest_Type) error
 	SendTxV2(context.Context, *commandspb.Transaction, api.SubmitTransactionV2Request_Type) error
 	HealthCheck(context.Context) error
 	LastBlockHeight(context.Context) (uint64, error)
 }
 
-func NewService(log *zap.Logger, cfg *Config, rootPath string) (*Service, error) {
-	log = log.Named(namedLogger)
+func NewService(log *zap.Logger, cfg *config.Config, rootPath string) (*Service, error) {
+	log = log.Named("wallet")
 
-	fileStore, err := NewFileStoreV1(rootPath)
+	store, err := storev1.NewStore(rootPath)
 	if err != nil {
 		return nil, err
 	}
-	auth, err := NewAuth(log, rootPath, cfg.TokenExpiry.Get())
+	auth, err := NewAuth(log, store, cfg.TokenExpiry.Get())
 	if err != nil {
 		return nil, err
 	}
-	nodeForward, err := NewNodeForward(log, cfg.Nodes)
+	nodeForward, err := newNodeForward(log, cfg.Nodes)
 	if err != nil {
 		return nil, err
 	}
-	handler := NewHandler(auth, fileStore)
-	return NewServiceWith(log, cfg, handler, nodeForward)
+	handler := wallet.NewHandler(store)
+	return NewServiceWith(log, cfg, handler, auth, nodeForward)
 }
 
-func NewServiceWith(log *zap.Logger, cfg *Config, h WalletHandler, n NodeForward) (*Service, error) {
+func NewServiceWith(log *zap.Logger, cfg *config.Config, h WalletHandler, a Auth, n NodeForward) (*Service, error) {
 	s := &Service{
 		Router:      httprouter.New(),
 		log:         log,
 		cfg:         cfg,
 		handler:     h,
+		auth:        a,
 		nodeForward: n,
 	}
 
@@ -179,7 +321,7 @@ func NewServiceWith(log *zap.Logger, cfg *Config, h WalletHandler, n NodeForward
 func (s *Service) Start() error {
 	s.s = &http.Server{
 		Addr:    fmt.Sprintf("%s:%v", s.cfg.Host, s.cfg.Port),
-		Handler: cors.AllowAll().Handler(s), // middlewar with cors
+		Handler: cors.AllowAll().Handler(s),
 	}
 
 	return s.s.ListenAndServe()
@@ -190,70 +332,69 @@ func (s *Service) Stop() error {
 }
 
 func (s *Service) CreateWallet(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	// unmarshal request
-	req := CreateLoginWalletRequest{}
-	if err := unmarshalBody(r, &req); err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
+	req, errs := ParseCreateLoginWalletRequest(r)
+	if !errs.Empty() {
+		s.writeBadRequest(w, errs)
 		return
 	}
 
-	// validation
-	if len(req.Wallet) <= 0 {
-		writeError(w, newError("missing wallet field"), http.StatusBadRequest)
-		return
-	}
-	if len(req.Passphrase) <= 0 {
-		writeError(w, newError("missing passphrase field"), http.StatusBadRequest)
+	err := s.handler.CreateWallet(req.Wallet, req.Passphrase)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
 
-	token, err := s.handler.CreateWallet(req.Wallet, req.Passphrase)
+	token, err := s.auth.NewSession(req.Wallet)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
-	writeSuccess(w, TokenResponse{token}, http.StatusOK)
+	writeSuccess(w, TokenResponse{Token: token}, http.StatusOK)
 }
 
-func (s *Service) DownloadWallet(token string, w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	path, err := s.handler.GetWalletPath(token)
-	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
+func (s *Service) Login(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	req, errs := ParseCreateLoginWalletRequest(r)
+	if !errs.Empty() {
+		s.writeBadRequest(w, errs)
 		return
 	}
-	http.ServeFile(w, r, path)
-}
 
-func (s *Service) Login(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	req := CreateLoginWalletRequest{}
-	if err := unmarshalBody(r, &req); err != nil {
-		writeError(w, err, http.StatusBadRequest)
+	err := s.handler.LoginWallet(req.Wallet, req.Passphrase)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
 
-	// validation
-	if len(req.Wallet) <= 0 {
-		writeError(w, newError("missing wallet field"), http.StatusBadRequest)
+	token, err := s.auth.NewSession(req.Wallet)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
-	if len(req.Passphrase) <= 0 {
-		writeError(w, newError("missing passphrase field"), http.StatusBadRequest)
+
+	writeSuccess(w, TokenResponse{Token: token}, http.StatusOK)
+}
+
+func (s *Service) DownloadWallet(token string, w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	name, err := s.auth.VerifyToken(token)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
 
-	token, err := s.handler.LoginWallet(req.Wallet, req.Passphrase)
+	path, err := s.handler.GetWalletPath(name)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		s.writeBadRequest(w, commands.NewErrors().FinalAdd(err))
 		return
 	}
-	writeSuccess(w, TokenResponse{token}, http.StatusOK)
+
+	http.ServeFile(w, r, path)
 }
 
-func (s *Service) Revoke(t string, w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	err := s.handler.RevokeToken(t)
+func (s *Service) Revoke(t string, w http.ResponseWriter, _ *http.Request, _ httprouter.Params) {
+	err := s.auth.Revoke(t)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
@@ -261,34 +402,36 @@ func (s *Service) Revoke(t string, w http.ResponseWriter, r *http.Request, _ htt
 }
 
 func (s *Service) GenerateKeypair(t string, w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	req := PassphraseMetaRequest{}
-	if err := unmarshalBody(r, &req); err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
+	req, errs := ParseGenKeyPairRequest(r)
+	if !errs.Empty() {
+		s.writeBadRequest(w, errs)
 		return
 	}
-	if len(req.Passphrase) <= 0 {
-		writeError(w, newError("missing passphrase field"), http.StatusBadRequest)
+
+	name, err := s.auth.VerifyToken(t)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
 
-	pubKey, err := s.handler.GenerateKeypair(t, req.Passphrase)
+	pubKey, err := s.handler.SecureGenerateKeyPair(name, req.Passphrase)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
 	// if any meta specified, lets add them
 	if len(req.Meta) > 0 {
-		err := s.handler.UpdateMeta(t, pubKey, req.Passphrase, req.Meta)
+		err := s.handler.UpdateMeta(name, pubKey, req.Passphrase, req.Meta)
 		if err != nil {
-			writeError(w, newError(err.Error()), http.StatusForbidden)
+			writeForbiddenError(w, err)
 			return
 		}
 	}
 
-	key, err := s.handler.GetPublicKey(t, pubKey)
+	key, err := s.handler.GetPublicKey(name, pubKey)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
+		s.writeBadRequest(w, commands.NewErrors().FinalAdd(err))
 		return
 	}
 
@@ -296,15 +439,21 @@ func (s *Service) GenerateKeypair(t string, w http.ResponseWriter, r *http.Reque
 }
 
 func (s *Service) GetPublicKey(t string, w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
-	key, err := s.handler.GetPublicKey(t, ps.ByName("keyid"))
+	name, err := s.auth.VerifyToken(t)
+	if err != nil {
+		writeForbiddenError(w, err)
+		return
+	}
+
+	key, err := s.handler.GetPublicKey(name, ps.ByName("keyid"))
 	if err != nil {
 		var statusCode int
-		if err == ErrPubKeyDoesNotExist {
+		if err == wallet.ErrPubKeyDoesNotExist {
 			statusCode = http.StatusNotFound
 		} else {
 			statusCode = http.StatusForbidden
 		}
-		writeError(w, newError(err.Error()), statusCode)
+		writeError(w, newErrorResponse(err.Error()), statusCode)
 		return
 	}
 
@@ -312,9 +461,15 @@ func (s *Service) GetPublicKey(t string, w http.ResponseWriter, r *http.Request,
 }
 
 func (s *Service) ListPublicKeys(t string, w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	keys, err := s.handler.ListPublicKeys(t)
+	name, err := s.auth.VerifyToken(t)
+	if err != nil {
+		writeForbiddenError(w, err)
+		return
+	}
+
+	keys, err := s.handler.ListPublicKeys(name)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
@@ -322,24 +477,22 @@ func (s *Service) ListPublicKeys(t string, w http.ResponseWriter, r *http.Reques
 }
 
 func (s *Service) TaintKey(t string, w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
-	req := PassphraseRequest{}
-	if err := unmarshalBody(r, &req); err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
-		return
-	}
 	keyID := ps.ByName("keyid")
-	if len(keyID) <= 0 {
-		writeError(w, newError("missing keyID"), http.StatusBadRequest)
+	req, errs := ParseTaintKeyRequest(r, keyID)
+	if !errs.Empty() {
+		s.writeBadRequest(w, errs)
 		return
 	}
-	if len(req.Passphrase) <= 0 {
-		writeError(w, newError("missing passphrase field"), http.StatusBadRequest)
+
+	name, err := s.auth.VerifyToken(t)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
 
-	err := s.handler.TaintKey(t, keyID, req.Passphrase)
+	err = s.handler.TaintKey(name, keyID, req.Passphrase)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
@@ -347,24 +500,22 @@ func (s *Service) TaintKey(t string, w http.ResponseWriter, r *http.Request, ps
 }
 
 func (s *Service) UpdateMeta(t string, w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
-	req := PassphraseMetaRequest{}
-	if err := unmarshalBody(r, &req); err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
-		return
-	}
 	keyID := ps.ByName("keyid")
-	if len(keyID) <= 0 {
-		writeError(w, newError("missing keyID"), http.StatusBadRequest)
+	req, errs := ParseUpdateMetaRequest(r, keyID)
+	if !errs.Empty() {
+		s.writeBadRequest(w, errs)
 		return
 	}
-	if len(req.Passphrase) <= 0 {
-		writeError(w, newError("missing passphrase field"), http.StatusBadRequest)
+
+	name, err := s.auth.VerifyToken(t)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
 
-	err := s.handler.UpdateMeta(t, keyID, req.Passphrase, req.Meta)
+	err = s.handler.UpdateMeta(name, keyID, req.Passphrase, req.Meta)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
@@ -372,23 +523,21 @@ func (s *Service) UpdateMeta(t string, w http.ResponseWriter, r *http.Request, p
 }
 
 func (s *Service) SignAny(t string, w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	req := SignAnyRequest{}
-	if err := unmarshalBody(r, &req); err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
-		return
-	}
-	if len(req.InputData) <= 0 {
-		writeError(w, newError("missing inputData field"), http.StatusBadRequest)
+	req, errs := ParseSignAnyRequest(r)
+	if !errs.Empty() {
+		s.writeBadRequest(w, errs)
 		return
 	}
-	if len(req.PubKey) <= 0 {
-		writeError(w, newError("missing pubKey field"), http.StatusBadRequest)
+
+	name, err := s.auth.VerifyToken(t)
+	if err != nil {
+		writeForbiddenError(w, err)
 		return
 	}
 
-	signature, err := s.handler.SignAny(t, req.InputData, req.PubKey)
+	signature, err := s.handler.SignAny(name, req.InputData, req.PubKey)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
@@ -415,30 +564,27 @@ func (s *Service) SignTxV2(token string, w http.ResponseWriter, r *http.Request,
 func (s *Service) signTxV2(token string, w http.ResponseWriter, r *http.Request, _ httprouter.Params, ty api.SubmitTransactionV2Request_Type) {
 	defer r.Body.Close()
 
-	errs := commands.NewErrors()
-	req := walletpb.SubmitTransactionRequest{}
-
-	if err := jsonpb.Unmarshal(r.Body, &req); err != nil {
-		errs.Add(errors.New("couldn't parse the request"))
+	req, errs := ParseSubmitTransactionRequest(r)
+	if !errs.Empty() {
 		s.writeBadRequest(w, errs)
 		return
 	}
 
-	errs.Merge(CheckSubmitTransactionRequest(req))
-	if !errs.Empty() {
-		s.writeBadRequest(w, errs)
+	height, err := s.nodeForward.LastBlockHeight(r.Context())
+	if err != nil {
+		writeInternalError(w, ErrCouldNotGetBlockHeight)
 		return
 	}
 
-	height, err := s.nodeForward.LastBlockHeight(r.Context())
+	name, err := s.auth.VerifyToken(token)
 	if err != nil {
-		writeError(w, newError("could not get last block height"), http.StatusInternalServerError)
+		writeForbiddenError(w, err)
 		return
 	}
 
-	tx, err := s.handler.SignTxV2(token, req, height)
+	tx, err := s.handler.SignTxV2(name, req, height)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
 		return
 	}
 
@@ -452,7 +598,7 @@ func (s *Service) signTxV2(token string, w http.ResponseWriter, r *http.Request,
 				}
 				writeError(w, newErrorWithDetails(err.Error(), details), http.StatusInternalServerError)
 			} else {
-				writeError(w, newError(err.Error()), http.StatusInternalServerError)
+				writeInternalError(w, err)
 			}
 			return
 		}
@@ -461,8 +607,12 @@ func (s *Service) signTxV2(token string, w http.ResponseWriter, r *http.Request,
 	writeSuccessProto(w, tx, http.StatusOK)
 }
 
-type ErrorResponse struct {
-	Errors commands.Errors `json:"errors"`
+func (s *Service) health(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	if err := s.nodeForward.HealthCheck(r.Context()); err != nil {
+		writeSuccess(w, SuccessResponse{Success: false}, http.StatusFailedDependency)
+		return
+	}
+	writeSuccess(w, SuccessResponse{Success: true}, http.StatusOK)
 }
 
 func (s *Service) writeBadRequest(w http.ResponseWriter, errs commands.Errors) {
@@ -472,7 +622,7 @@ func (s *Service) writeBadRequest(w http.ResponseWriter, errs commands.Errors) {
 func (s *Service) writeErrors(w http.ResponseWriter, statusCode int, errs commands.Errors) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(statusCode)
-	buf, _ := json.Marshal(ErrorResponse{Errors: errs})
+	buf, _ := json.Marshal(ErrorsResponse{Errors: errs})
 	if _, err := w.Write(buf); err != nil {
 		s.log.Error(fmt.Sprintf("couldn't marshal errors as JSON because of: %s", err.Error()),
 			zap.Error(errs),
@@ -481,23 +631,23 @@ func (s *Service) writeErrors(w http.ResponseWriter, statusCode int, errs comman
 	}
 }
 
-func (s *Service) health(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
-	if err := s.nodeForward.HealthCheck(r.Context()); err != nil {
-		writeSuccess(w, SuccessResponse{Success: false}, http.StatusFailedDependency)
-		return
-	}
-	writeSuccess(w, SuccessResponse{Success: true}, http.StatusOK)
-}
-
 func unmarshalBody(r *http.Request, into interface{}) error {
 	defer r.Body.Close()
 	body, err := ioutil.ReadAll(r.Body)
 	if err != nil {
-		return ErrInvalidRequest
+		return ErrCouldNotReadRequest
 	}
 	return json.Unmarshal(body, into)
 }
 
+func writeForbiddenError(w http.ResponseWriter, e error) {
+	writeError(w, newErrorResponse(e.Error()), http.StatusForbidden)
+}
+
+func writeInternalError(w http.ResponseWriter, e error) {
+	writeError(w, newErrorResponse(e.Error()), http.StatusInternalServerError)
+}
+
 func writeError(w http.ResponseWriter, e error, status int) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
@@ -518,30 +668,3 @@ func writeSuccessProto(w http.ResponseWriter, data proto.Message, status int) {
 	marshaler := jsonpb.Marshaler{}
 	marshaler.Marshal(w, data)
 }
-
-var (
-	ErrInvalidRequest        = newError("invalid request")
-	ErrInvalidOrMissingToken = newError("invalid or missing token")
-)
-
-type HTTPError struct {
-	ErrorStr string   `json:"error"`
-	Details  []string `json:"details"`
-}
-
-func (e HTTPError) Error() string {
-	return e.ErrorStr
-}
-
-func newError(e string) HTTPError {
-	return HTTPError{
-		ErrorStr: e,
-	}
-}
-
-func newErrorWithDetails(e string, details []string) HTTPError {
-	return HTTPError{
-		ErrorStr: e,
-		Details:  details,
-	}
-}
diff --git a/wallet/service_deprecated.go b/service/service_deprecated.go
similarity index 73%
rename from wallet/service_deprecated.go
rename to service/service_deprecated.go
index db77f4c..029874f 100644
--- a/wallet/service_deprecated.go
+++ b/service/service_deprecated.go
@@ -1,4 +1,4 @@
-package wallet
+package service
 
 import (
 	"encoding/base64"
@@ -28,27 +28,33 @@ func (s *Service) SignTx(t string, w http.ResponseWriter, r *http.Request, p htt
 func (s *Service) signTx(t string, w http.ResponseWriter, r *http.Request, _ httprouter.Params, ty api.SubmitTransactionRequest_Type) {
 	req := SignTxRequest{}
 	if err := unmarshalBody(r, &req); err != nil {
-		writeError(w, newError(err.Error()), http.StatusBadRequest)
+		writeError(w, newErrorResponse(err.Error()), http.StatusBadRequest)
 		return
 	}
 	if len(req.Tx) <= 0 {
-		writeError(w, newError("missing tx field"), http.StatusBadRequest)
+		writeError(w, newErrorResponse("missing tx field"), http.StatusBadRequest)
 		return
 	}
 	if len(req.PubKey) <= 0 {
-		writeError(w, newError("missing pubKey field"), http.StatusBadRequest)
+		writeError(w, newErrorResponse("missing pubKey field"), http.StatusBadRequest)
 		return
 	}
 
 	height, err := s.nodeForward.LastBlockHeight(r.Context())
 	if err != nil {
-		writeError(w, newError("could not get last block height"), http.StatusInternalServerError)
+		writeError(w, newErrorResponse("could not get last block height"), http.StatusInternalServerError)
 		return
 	}
 
-	sb, err := s.handler.SignTx(t, req.Tx, req.PubKey, height)
+	name, err := s.auth.VerifyToken(t)
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusForbidden)
+		writeForbiddenError(w, err)
+		return
+	}
+
+	sb, err := s.handler.SignTx(name, req.Tx, req.PubKey, height)
+	if err != nil {
+		writeError(w, newErrorResponse(err.Error()), http.StatusForbidden)
 		return
 	}
 
@@ -62,7 +68,7 @@ func (s *Service) signTx(t string, w http.ResponseWriter, r *http.Request, _ htt
 				}
 				writeError(w, newErrorWithDetails(err.Error(), details), http.StatusInternalServerError)
 			} else {
-				writeError(w, newError(err.Error()), http.StatusInternalServerError)
+				writeError(w, newErrorResponse(err.Error()), http.StatusInternalServerError)
 			}
 			return
 		}
@@ -70,7 +76,7 @@ func (s *Service) signTx(t string, w http.ResponseWriter, r *http.Request, _ htt
 
 	rawBundle, err := proto.Marshal(sb.IntoProto())
 	if err != nil {
-		writeError(w, newError(err.Error()), http.StatusInternalServerError)
+		writeError(w, newErrorResponse(err.Error()), http.StatusInternalServerError)
 		return
 	}
 
diff --git a/store/v1/store.go b/store/v1/store.go
new file mode 100644
index 0000000..a88303f
--- /dev/null
+++ b/store/v1/store.go
@@ -0,0 +1,271 @@
+package v1
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"code.vegaprotocol.io/go-wallet/config"
+	"code.vegaprotocol.io/go-wallet/fsutil"
+	"code.vegaprotocol.io/go-wallet/wallet"
+	"code.vegaprotocol.io/go-wallet/wallet/crypto"
+	"github.com/zannen/toml"
+)
+
+const (
+	configFile       = "wallet-service-config.toml"
+	rsaKeyPath       = "wallet_rsa"
+	pubRsaKeyName    = "public.pem"
+	privRsaKeyName   = "private.pem"
+	walletBaseFolder = "wallets"
+)
+
+var (
+	ErrRSAFolderDoesNotExists = errors.New("RSA folder does not exist")
+)
+
+type Store struct {
+	rootPath           string
+	keyFolderPath      string
+	pubRsaKeyFileName  string
+	privRsaKeyFileName string
+	configFileName     string
+	walletBasePath     string
+}
+
+func NewStore(rootPath string) (*Store, error) {
+	keyFolderPath := filepath.Join(rootPath, rsaKeyPath)
+
+	return &Store{
+		rootPath:           rootPath,
+		keyFolderPath:      keyFolderPath,
+		pubRsaKeyFileName:  filepath.Join(keyFolderPath, pubRsaKeyName),
+		privRsaKeyFileName: filepath.Join(keyFolderPath, privRsaKeyName),
+		configFileName:     filepath.Join(rootPath, configFile),
+		walletBasePath:     filepath.Join(rootPath, walletBaseFolder),
+	}, nil
+}
+
+// Initialise creates the folders. It does nothing if a folder already
+// exists.
+func (s *Store) Initialise() error {
+	err := createFolder(s.rootPath)
+	if err != nil {
+		return err
+	}
+
+	err = createFolder(s.walletBasePath)
+	if err != nil {
+		return err
+	}
+
+	err = createFolder(s.keyFolderPath)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func createFolder(folder string) error {
+	ok, err := fsutil.PathExists(folder)
+	if !ok {
+		if _, ok := err.(*fsutil.PathNotFound); !ok {
+			return fmt.Errorf("invalid directory path %s: %v", folder, err)
+		}
+
+		if err := fsutil.EnsureDir(folder); err != nil {
+			return fmt.Errorf("error creating directory %s: %v", folder, err)
+		}
+	}
+	return nil
+}
+
+func (s *Store) WalletExists(name string) bool {
+	walletPath := s.walletPath(name)
+
+	ok, _ := fsutil.PathExists(walletPath)
+	return ok
+}
+
+func (s *Store) GetWallet(name, passphrase string) (wallet.Wallet, error) {
+	walletPath := s.walletPath(name)
+
+	if ok, _ := fsutil.PathExists(walletPath); !ok {
+		return wallet.Wallet{}, wallet.ErrWalletDoesNotExists
+	}
+
+	buf, err := ioutil.ReadFile(walletPath)
+	if err != nil {
+		return wallet.Wallet{}, err
+	}
+
+	decBuf, err := crypto.Decrypt(buf, passphrase)
+	if err != nil {
+		return wallet.Wallet{}, err
+	}
+
+	w := &wallet.Wallet{}
+	err = json.Unmarshal(decBuf, w)
+	return *w, err
+}
+
+func (s *Store) SaveWallet(w wallet.Wallet, passphrase string) error {
+	buf, err := json.Marshal(w)
+	if err != nil {
+		return err
+	}
+
+	encBuf, err := crypto.Encrypt(buf, passphrase)
+	if err != nil {
+		return err
+	}
+
+	f, err := os.Create(s.walletPath(w.Owner))
+	if err != nil {
+		return err
+	}
+
+	_, err = f.Write(encBuf)
+	if err != nil {
+		return err
+	}
+
+	return f.Close()
+}
+
+func (s *Store) GetWalletPath(name string) string {
+	return s.walletPath(name)
+}
+
+func (s *Store) GetConfig() (*config.Config, error) {
+	buf, err := ioutil.ReadFile(s.configFileName)
+	if err != nil {
+		return nil, err
+	}
+
+	cfg := config.NewDefaultConfig()
+
+	if _, err := toml.Decode(string(buf), &cfg); err != nil {
+		return nil, err
+	}
+
+	return &cfg, nil
+}
+
+func (s *Store) SaveConfig(cfg *config.Config, overwrite bool) error {
+	confPathExists, _ := fsutil.FileExists(s.configFileName)
+
+	if confPathExists {
+		if overwrite {
+			if err := s.removeConfigFile(); err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("configuration already exists at path: %v", s.configFileName)
+		}
+	}
+
+	// write configuration to toml
+	buf := new(bytes.Buffer)
+	if err := toml.NewEncoder(buf).Encode(cfg); err != nil {
+		return err
+	}
+
+	// create the configuration file
+	f, err := os.Create(s.configFileName)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	if _, err = f.WriteString(buf.String()); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *Store) SaveRSAKeys(keys *wallet.RSAKeys, overwrite bool) error {
+	if ok, _ := fsutil.PathExists(s.keyFolderPath); !ok {
+		return ErrRSAFolderDoesNotExists
+	}
+
+	privKeyExists, _ := fsutil.FileExists(s.privRsaKeyFileName)
+	pubKeyExists, _ := fsutil.FileExists(s.pubRsaKeyFileName)
+	if privKeyExists && pubKeyExists {
+		if overwrite {
+			if err := s.removeExistingRSAKeys(); err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("RSA keys already exist at path: %v", s.keyFolderPath)
+		}
+	}
+
+	if err := writeFile(keys.Priv, s.privRsaKeyFileName); err != nil {
+		return fmt.Errorf("unable to write private key: %v", err)
+	}
+
+	if err := writeFile(keys.Pub, s.pubRsaKeyFileName); err != nil {
+		return fmt.Errorf("unable to write private key: %v", err)
+	}
+
+	return nil
+}
+
+func (s *Store) GetRsaKeys() (*wallet.RSAKeys, error) {
+	pub, err := ioutil.ReadFile(s.pubRsaKeyFileName)
+	if err != nil {
+		return nil, err
+	}
+
+	priv, err := ioutil.ReadFile(s.privRsaKeyFileName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &wallet.RSAKeys{
+		Pub:  pub,
+		Priv: priv,
+	}, nil
+}
+
+func (s *Store) removeConfigFile() error {
+	if err := os.Remove(s.configFileName); err != nil {
+		return fmt.Errorf("unable to remove configuration: %v", err)
+	}
+
+	return nil
+}
+
+func (s *Store) removeExistingRSAKeys() error {
+	if err := os.RemoveAll(s.keyFolderPath); err != nil {
+		return fmt.Errorf("unable to remove RSA keys: %v", err)
+	}
+
+	return createFolder(s.keyFolderPath)
+}
+
+func (s *Store) walletPath(name string) string {
+	return filepath.Join(s.rootPath, walletBaseFolder, name)
+}
+
+func writeFile(content []byte, fileName string) error {
+	pemFile, err := os.Create(fileName)
+	if err != nil {
+		return err
+	}
+	defer pemFile.Close()
+
+	_, err = pemFile.Write(content)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/wallet/commands.go b/wallet/commands.go
index b140410..16a5253 100644
--- a/wallet/commands.go
+++ b/wallet/commands.go
@@ -5,7 +5,7 @@ import (
 	walletpb "github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/wallet/v1"
 )
 
-func CheckSubmitTransactionRequest(req walletpb.SubmitTransactionRequest) commands.Errors {
+func CheckSubmitTransactionRequest(req *walletpb.SubmitTransactionRequest) commands.Errors {
 	errs := commands.NewErrors()
 
 	if len(req.PubKey) == 0 {
diff --git a/wallet/config.go b/wallet/config.go
deleted file mode 100644
index b27ba60..0000000
--- a/wallet/config.go
+++ /dev/null
@@ -1,242 +0,0 @@
-package wallet
-
-import (
-	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/pem"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"time"
-
-	"code.vegaprotocol.io/go-wallet/config/encoding"
-	"code.vegaprotocol.io/go-wallet/fsutil"
-
-	"github.com/zannen/toml"
-	"go.uber.org/zap"
-)
-
-const (
-	namedLogger    = "wallet"
-	configFile     = "wallet-service-config.toml"
-	rsaKeyPath     = "wallet_rsa"
-	pubRsaKeyName  = "public.pem"
-	privRsaKeyName = "private.pem"
-
-	//  7 days, needs to be in seconds for the token
-	tokenExpiry = time.Hour * 24 * 7
-)
-
-type Config struct {
-	Level       encoding.LogLevel
-	TokenExpiry encoding.Duration
-	Port        int
-	Host        string
-	Nodes       NodesConfig
-	RsaKey      string
-	Console     ConsoleConfig
-}
-
-type ConsoleConfig struct {
-	URL       string
-	LocalPort int
-}
-
-type NodesConfig struct {
-	Hosts   []string
-	Retries uint64
-}
-
-// NewDefaultConfig creates an instance of the package specific configuration, given a
-// pointer to a logger instance to be used for logging within the package.
-func NewDefaultConfig() Config {
-	return Config{
-		Level:       encoding.LogLevel{Level: zap.InfoLevel},
-		TokenExpiry: encoding.Duration{Duration: tokenExpiry},
-		Nodes: NodesConfig{
-			Hosts: []string{
-				"n01.testnet.vega.xyz:3002",
-				"n02.testnet.vega.xyz:3002",
-				"n03.testnet.vega.xyz:3002",
-				"n04.testnet.vega.xyz:3002",
-				"n05.testnet.vega.xyz:3002",
-				"n06.testnet.vega.xyz:3002",
-				"n07.testnet.vega.xyz:3002",
-				"n08.testnet.vega.xyz:3002",
-				"n09.testnet.vega.xyz:3002",
-				"n10.testnet.vega.xyz:3002",
-				"n11.testnet.vega.xyz:3002",
-				"n12.testnet.vega.xyz:3002",
-				"n13.testnet.vega.xyz:3002",
-				"n14.testnet.vega.xyz:3002",
-				"n15.testnet.vega.xyz:3002",
-				"n16.testnet.vega.xyz:3002",
-				"n17.testnet.vega.xyz:3002",
-				"n18.testnet.vega.xyz:3002",
-				"n19.testnet.vega.xyz:3002",
-				"n20.testnet.vega.xyz:3002",
-			},
-			Retries: 5,
-		},
-		Host:   "127.0.0.1",
-		Port:   1789,
-		RsaKey: rsaKeyPath,
-		Console: ConsoleConfig{
-			URL:       "console.fairground.wtf",
-			LocalPort: 1847,
-		},
-	}
-}
-
-func LoadConfig(path string) (*Config, error) {
-	buf, err := ioutil.ReadFile(filepath.Join(path, configFile))
-	if err != nil {
-		return nil, err
-	}
-	cfg := NewDefaultConfig()
-	if _, err := toml.Decode(string(buf), &cfg); err != nil {
-		return nil, err
-	}
-
-	return &cfg, nil
-}
-
-func GenConfig(log *zap.Logger, path string, rewrite, genRsaKey bool) error {
-	confPath := filepath.Join(path, configFile)
-
-	confPathExists, _ := fsutil.PathExists(confPath)
-
-	if confPathExists {
-		if rewrite {
-			log.Info("removing existing configuration",
-				zap.String("path", confPath))
-			err := os.Remove(confPath)
-			if err != nil {
-				return fmt.Errorf("unable to remove configuration: %v", err)
-			}
-		} else {
-			// file exist, but not allowed to rewrite, return an error
-			return fmt.Errorf("configuration already exists at path: %v", confPath)
-		}
-	}
-
-	cfg := NewDefaultConfig()
-
-	// write configuration to toml
-	buf := new(bytes.Buffer)
-	if err := toml.NewEncoder(buf).Encode(cfg); err != nil {
-		return err
-	}
-
-	// create the configuration file
-	f, err := os.Create(confPath)
-	if err != nil {
-		return err
-	}
-
-	if _, err = f.WriteString(buf.String()); err != nil {
-		return err
-	}
-
-	log.Info("wallet service configuration generated successfully", zap.String("path", confPath))
-
-	if genRsaKey {
-		if err := GenRsaKeyFiles(log, path, rewrite); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func GenRsaKeyFiles(log *zap.Logger, path string, rewrite bool) error {
-	keyFolderPath := filepath.Join(path, rsaKeyPath)
-	confPathExists, _ := fsutil.PathExists(keyFolderPath)
-	if confPathExists {
-		if rewrite {
-			log.Info("removing existing rsa keys",
-				zap.String("path", keyFolderPath))
-			err := os.RemoveAll(keyFolderPath)
-			if err != nil {
-				return fmt.Errorf("unable to remove rsa keys: %v", err)
-			}
-		} else {
-			// file exist, but not allowed to rewrite, return an error
-			return fmt.Errorf("rsa keys already exists at path: %v", rsaKeyPath)
-		}
-	}
-
-	// create the folder then
-	if err := fsutil.EnsureDir(keyFolderPath); err != nil {
-		return fmt.Errorf("unable to create the rsa key folder: %v", err)
-	}
-
-	bitSize := 4096
-
-	key, err := rsa.GenerateKey(rand.Reader, bitSize)
-	if err != nil {
-		return fmt.Errorf("unable to generate rsa keys: %v", err)
-	}
-
-	if err := savePEMKey(filepath.Join(keyFolderPath, privRsaKeyName), key); err != nil {
-		return fmt.Errorf("unable to write private key: %v", err)
-	}
-
-	if err := savePublicPEMKey(filepath.Join(keyFolderPath, pubRsaKeyName), key.PublicKey); err != nil {
-		return fmt.Errorf("unable to write private key: %v", err)
-	}
-
-	log.Info("wallet rsa key generated successfully", zap.String("path", keyFolderPath))
-
-	return nil
-}
-
-func savePEMKey(fileName string, key *rsa.PrivateKey) error {
-	outFile, err := os.Create(fileName)
-	if err != nil {
-		return err
-	}
-	defer outFile.Close()
-
-	var privateKey = &pem.Block{
-		Type:  "RSA PRIVATE KEY",
-		Bytes: x509.MarshalPKCS1PrivateKey(key),
-	}
-
-	return pem.Encode(outFile, privateKey)
-}
-
-func savePublicPEMKey(fileName string, pubkey rsa.PublicKey) error {
-	pubBytes, err := x509.MarshalPKIXPublicKey(&pubkey)
-	if err != nil {
-		return err
-	}
-
-	var pemkey = &pem.Block{
-		Type:  "PUBLIC KEY",
-		Bytes: pubBytes,
-	}
-
-	pemfile, err := os.Create(fileName)
-	if err != nil {
-		return err
-	}
-	defer pemfile.Close()
-
-	return pem.Encode(pemfile, pemkey)
-}
-
-func readRsaKeys(rootPath string) (pub []byte, priv []byte, err error) {
-	pub, err = ioutil.ReadFile(filepath.Join(rootPath, rsaKeyPath, pubRsaKeyName))
-	if err != nil {
-		return nil, nil, err
-	}
-	priv, err = ioutil.ReadFile(filepath.Join(rootPath, rsaKeyPath, privRsaKeyName))
-	if err != nil {
-		return nil, nil, err
-	}
-	return
-}
diff --git a/wallet/file_store_v1.go b/wallet/file_store_v1.go
deleted file mode 100644
index f36aeaa..0000000
--- a/wallet/file_store_v1.go
+++ /dev/null
@@ -1,84 +0,0 @@
-package wallet
-
-import (
-	"encoding/json"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"code.vegaprotocol.io/go-wallet/fsutil"
-	"code.vegaprotocol.io/go-wallet/wallet/crypto"
-)
-
-const (
-	walletBaseFolder = "wallets"
-)
-
-type FileV1 struct {
-	rootPath string
-}
-
-func NewFileStoreV1(rootPath string) (*FileV1, error) {
-	err := fsutil.EnsureDir(filepath.Join(rootPath, walletBaseFolder))
-	if err != nil {
-		return nil, err
-	}
-
-	return &FileV1{
-		rootPath: rootPath,
-	}, nil
-}
-
-func (c *FileV1) GetWallet(name, passphrase string) (Wallet, error) {
-	walletPath := c.walletPath(name)
-
-	if ok, _ := fsutil.PathExists(walletPath); !ok {
-		return Wallet{}, ErrWalletDoesNotExists
-	}
-
-	buf, err := ioutil.ReadFile(walletPath)
-	if err != nil {
-		return Wallet{}, err
-	}
-
-	decBuf, err := crypto.Decrypt(buf, passphrase)
-	if err != nil {
-		return Wallet{}, err
-	}
-
-	w := &Wallet{}
-	err = json.Unmarshal(decBuf, w)
-	return *w, err
-}
-
-func (c *FileV1) SaveWallet(w Wallet, passphrase string) error {
-	buf, err := json.Marshal(w)
-	if err != nil {
-		return err
-	}
-
-	encBuf, err := crypto.Encrypt(buf, passphrase)
-	if err != nil {
-		return err
-	}
-
-	f, err := os.Create(c.walletPath(w.Owner))
-	if err != nil {
-		return err
-	}
-
-	_, err = f.Write(encBuf)
-	if err != nil {
-		return err
-	}
-
-	return f.Close()
-}
-
-func (c *FileV1) GetWalletPath(name string) string {
-	return c.walletPath(name)
-}
-
-func (c *FileV1) walletPath(name string) string {
-	return filepath.Join(c.rootPath, walletBaseFolder, name)
-}
diff --git a/wallet/handler.go b/wallet/handler.go
index 02bd1f1..7b72e84 100644
--- a/wallet/handler.go
+++ b/wallet/handler.go
@@ -15,26 +15,18 @@ import (
 )
 
 var (
-	ErrPubKeyIsTainted      = errors.New("public key is tainted")
+	ErrPubKeyIsTainted = errors.New("public key is tainted")
 )
 
-// Auth ...
-//go:generate go run github.com/golang/mock/mockgen -destination mocks/auth_mock.go -package mocks code.vegaprotocol.io/go-wallet/wallet Auth
-type Auth interface {
-	NewSession(name string) (string, error)
-	VerifyToken(token string) (string, error)
-	Revoke(token string) error
-}
-
 // Store abstracts the underlying storage for wallet data.
 type Store interface {
+	WalletExists(name string) bool
 	SaveWallet(w Wallet, passphrase string) error
 	GetWallet(name, passphrase string) (Wallet, error)
 	GetWalletPath(name string) string
 }
 
 type Handler struct {
-	auth          Auth
 	store         Store
 	loggedWallets wallets
 
@@ -42,77 +34,76 @@ type Handler struct {
 	mu sync.RWMutex
 }
 
-func NewHandler(auth Auth, store Store) *Handler {
+func NewHandler(store Store) *Handler {
 	return &Handler{
-		auth:          auth,
 		store:         store,
 		loggedWallets: newWallets(),
 	}
 }
 
-// CreateWallet returns the token
-func (h *Handler) CreateWallet(name, passphrase string) (string, error) {
+func (h *Handler) WalletExists(name string) bool {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	return h.store.WalletExists(name)
+}
+
+func (h *Handler) CreateWallet(name, passphrase string) error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
 	_, err := h.store.GetWallet(name, passphrase)
 	if err != nil && err != ErrWalletDoesNotExists {
-		return "", err
+		return err
 	} else if err == nil {
-		return "", ErrWalletAlreadyExists
+		return ErrWalletAlreadyExists
 	}
 
 	w := NewWallet(name)
 
-	err = h.saveWallet(*w, passphrase)
-	if err != nil {
-		return "", err
-	}
-
-	return h.auth.NewSession(name)
+	return h.saveWallet(*w, passphrase)
 }
 
-// LoginWallet returns the token
-func (h *Handler) LoginWallet(name, passphrase string) (string, error) {
+func (h *Handler) LoginWallet(name, passphrase string) error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
 	w, err := h.store.GetWallet(name, passphrase)
 	if err != nil {
-		return "", ErrWalletDoesNotExists
+		return ErrWalletDoesNotExists
 	}
 
 	h.loggedWallets.Add(w)
 
-	return h.auth.NewSession(name)
-}
-
-func (h *Handler) RevokeToken(token string) error {
-	return h.auth.Revoke(token)
+	return nil
 }
 
-func (h *Handler) GenerateKeypair(token, passphrase string) (string, error) {
+func (h *Handler) GenerateKeyPair(name, passphrase string) (KeyPair, error) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
-	name, err := h.auth.VerifyToken(token)
-	if err != nil {
-		return "", err
-	}
-
 	w, err := h.store.GetWallet(name, passphrase)
 	if err != nil {
-		return "", err
+		return KeyPair{}, err
 	}
 
 	kp, err := GenKeypair(crypto.Ed25519)
 	if err != nil {
-		return "", err
+		return KeyPair{}, err
 	}
 
-	w.Keypairs.Upsert(*kp)
+	w.KeyRing.Upsert(*kp)
 
 	err = h.saveWallet(w, passphrase)
+	if err != nil {
+		return KeyPair{}, err
+	}
+
+	return kp.DeepCopy(), nil
+}
+
+func (h *Handler) SecureGenerateKeyPair(name, passphrase string) (string, error) {
+	kp, err := h.GenerateKeyPair(name, passphrase)
 	if err != nil {
 		return "", err
 	}
@@ -120,42 +111,31 @@ func (h *Handler) GenerateKeypair(token, passphrase string) (string, error) {
 	return kp.Pub, nil
 }
 
-func (h *Handler) GetPublicKey(token, pubKey string) (*Keypair, error) {
+func (h *Handler) GetPublicKey(name, pubKey string) (*PublicKey, error) {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 
-	kp, err := h.getKeyPair(token, pubKey)
+	kp, err := h.getKeyPair(name, pubKey)
 	if err != nil {
 		return nil, err
 	}
 
-	secureKeyPair := kp.SecureCopy()
-
-	return &secureKeyPair, nil
+	return kp.ToPublicKey(), nil
 }
 
-func (h *Handler) GetWalletName(token string) (string, error) {
-	return h.auth.VerifyToken(token)
-}
-
-func (h *Handler) ListPublicKeys(token string) ([]Keypair, error) {
+func (h *Handler) ListPublicKeys(name string) ([]PublicKey, error) {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 
-	name, err := h.auth.VerifyToken(token)
-	if err != nil {
-		return nil, err
-	}
-
 	w, err := h.loggedWallets.Get(name)
 	if err != nil {
 		return nil, err
 	}
 
-	return w.Keypairs.GetPubKeys(), nil
+	return w.KeyRing.GetPublicKeys(), nil
 }
 
-func (h *Handler) SignAny(token, inputData, pubKey string) ([]byte, error) {
+func (h *Handler) SignAny(name, inputData, pubKey string) ([]byte, error) {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 
@@ -164,7 +144,7 @@ func (h *Handler) SignAny(token, inputData, pubKey string) ([]byte, error) {
 		return nil, err
 	}
 
-	kp, err := h.getKeyPair(token, pubKey)
+	kp, err := h.getKeyPair(name, pubKey)
 	if err != nil {
 		return nil, err
 	}
@@ -176,11 +156,11 @@ func (h *Handler) SignAny(token, inputData, pubKey string) ([]byte, error) {
 	return kp.Algorithm.Sign(kp.privBytes, rawInputData)
 }
 
-func (h *Handler) SignTxV2(token string, req walletpb.SubmitTransactionRequest, height uint64) (*commandspb.Transaction, error) {
+func (h *Handler) SignTxV2(name string, req *walletpb.SubmitTransactionRequest, height uint64) (*commandspb.Transaction, error) {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 
-	keyPair, err := h.getKeyPair(token, req.GetPubKey())
+	keyPair, err := h.getKeyPair(name, req.GetPubKey())
 	if err != nil {
 		return nil, err
 	}
@@ -203,21 +183,38 @@ func (h *Handler) SignTxV2(token string, req walletpb.SubmitTransactionRequest,
 	return commands.NewTransaction(keyPair.pubBytes, marshalledData, signature), nil
 }
 
-func (h *Handler) TaintKey(token, pubKey, passphrase string) error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
+func (h *Handler) VerifyAny(name, inputData, sig, pubKey string) (bool, error) {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
 
-	name, err := h.auth.VerifyToken(token)
+	rawSig, err := base64.StdEncoding.DecodeString(sig)
 	if err != nil {
-		return err
+		return false, err
+	}
+
+	rawInputData, err := base64.StdEncoding.DecodeString(inputData)
+	if err != nil {
+		return false, err
+	}
+
+	kp, err := h.getKeyPair(name, pubKey)
+	if err != nil {
+		return false, err
 	}
 
+	return kp.Algorithm.Verify(kp.pubBytes, rawInputData, rawSig)
+}
+
+func (h *Handler) TaintKey(name, pubKey, passphrase string) error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
 	w, err := h.store.GetWallet(name, passphrase)
 	if err != nil {
 		return err
 	}
 
-	keyPair, err := w.Keypairs.FindPair(pubKey)
+	keyPair, err := w.KeyRing.FindPair(pubKey)
 	if err != nil {
 		return err
 	}
@@ -226,58 +223,43 @@ func (h *Handler) TaintKey(token, pubKey, passphrase string) error {
 		return err
 	}
 
-	w.Keypairs.Upsert(keyPair)
+	w.KeyRing.Upsert(keyPair)
 
 	return h.saveWallet(w, passphrase)
 }
 
-func (h *Handler) UpdateMeta(token, pubKey, passphrase string, meta []Meta) error {
+func (h *Handler) UpdateMeta(name, pubKey, passphrase string, meta []Meta) error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
-	name, err := h.auth.VerifyToken(token)
-	if err != nil {
-		return err
-	}
-
 	w, err := h.store.GetWallet(name, passphrase)
 	if err != nil {
 		return err
 	}
 
-	keyPair, err := w.Keypairs.FindPair(pubKey)
+	keyPair, err := w.KeyRing.FindPair(pubKey)
 	if err != nil {
 		return err
 	}
 
 	keyPair.Meta = meta
 
-	w.Keypairs.Upsert(keyPair)
+	w.KeyRing.Upsert(keyPair)
 
 	return h.saveWallet(w, passphrase)
 }
 
-func (h *Handler) GetWalletPath(token string) (string, error) {
-	name, err := h.auth.VerifyToken(token)
-	if err != nil {
-		return "", err
-	}
-
+func (h *Handler) GetWalletPath(name string) (string, error) {
 	return h.store.GetWalletPath(name), nil
 }
 
-func (h *Handler) getKeyPair(token, pubKey string) (*Keypair, error) {
-	name, err := h.auth.VerifyToken(token)
-	if err != nil {
-		return nil, err
-	}
-
+func (h *Handler) getKeyPair(name, pubKey string) (*KeyPair, error) {
 	wallet, err := h.loggedWallets.Get(name)
 	if err != nil {
 		return nil, err
 	}
 
-	keyPair, err := wallet.Keypairs.FindPair(pubKey)
+	keyPair, err := wallet.KeyRing.FindPair(pubKey)
 
 	return &keyPair, err
 }
@@ -293,7 +275,7 @@ func (h *Handler) saveWallet(w Wallet, passphrase string) error {
 	return nil
 }
 
-func wrapRequestCommandIntoInputData(data *commandspb.InputData, req walletpb.SubmitTransactionRequest) {
+func wrapRequestCommandIntoInputData(data *commandspb.InputData, req *walletpb.SubmitTransactionRequest) {
 	switch cmd := req.Command.(type) {
 	case *walletpb.SubmitTransactionRequest_OrderSubmission:
 		data.Command = &commandspb.InputData_OrderSubmission{
diff --git a/wallet/handler_deprecated.go b/wallet/handler_deprecated.go
index 898c12c..1c97f38 100644
--- a/wallet/handler_deprecated.go
+++ b/wallet/handler_deprecated.go
@@ -9,7 +9,7 @@ import (
 	"github.com/golang/protobuf/proto"
 )
 
-func (h *Handler) SignTx(token, tx, pubKey string, blockHeight uint64) (SignedBundle, error) {
+func (h *Handler) SignTx(name, tx, pubKey string, blockHeight uint64) (SignedBundle, error) {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
 
@@ -19,7 +19,7 @@ func (h *Handler) SignTx(token, tx, pubKey string, blockHeight uint64) (SignedBu
 		return SignedBundle{}, err
 	}
 
-	kp, err := h.getKeyPair(token, pubKey)
+	kp, err := h.getKeyPair(name, pubKey)
 	if err != nil {
 		return SignedBundle{}, err
 	}
diff --git a/wallet/keys.go b/wallet/keys.go
index b1f48c8..e3098ba 100644
--- a/wallet/keys.go
+++ b/wallet/keys.go
@@ -14,22 +14,22 @@ var (
 	ErrPubKeyAlreadyTainted = errors.New("public key is already tainted")
 )
 
-type KeyRing []Keypair
+type KeyRing []KeyPair
 
 func NewKeyRing() KeyRing {
-	return []Keypair{}
+	return []KeyPair{}
 }
 
-func (r KeyRing) FindPair(pubKey string) (Keypair, error) {
+func (r KeyRing) FindPair(pubKey string) (KeyPair, error) {
 	for i := range r {
 		if r[i].Pub == pubKey {
 			return r[i], nil
 		}
 	}
-	return Keypair{}, ErrPubKeyDoesNotExist
+	return KeyPair{}, ErrPubKeyDoesNotExist
 }
 
-func (r *KeyRing) Upsert(pair Keypair) {
+func (r *KeyRing) Upsert(pair KeyPair) {
 	for i := range *r {
 		if (*r)[i].Pub == pair.Pub && (*r)[i].Priv == pair.Priv {
 			(*r)[i] = pair
@@ -40,16 +40,15 @@ func (r *KeyRing) Upsert(pair Keypair) {
 	*r = append(*r, pair)
 }
 
-// GetPubKeys copy all keys so we do not propagate private keys
-func (r KeyRing) GetPubKeys() []Keypair {
-	pairs := make([]Keypair, 0, len(r))
+func (r KeyRing) GetPublicKeys() []PublicKey {
+	pubKeys := make([]PublicKey, 0, len(r))
 	for _, keyPair := range r {
-		pairs = append(pairs, keyPair.SecureCopy())
+		pubKeys = append(pubKeys, *keyPair.ToPublicKey())
 	}
-	return pairs
+	return pubKeys
 }
 
-type Keypair struct {
+type KeyPair struct {
 	Pub       string                    `json:"pub"`
 	Priv      string                    `json:"priv,omitempty"`
 	Algorithm crypto.SignatureAlgorithm `json:"algo"`
@@ -63,7 +62,7 @@ type Keypair struct {
 	privBytes []byte
 }
 
-func GenKeypair(algorithm string) (*Keypair, error) {
+func GenKeypair(algorithm string) (*KeyPair, error) {
 	algo, err := crypto.NewSignatureAlgorithm(algorithm)
 	if err != nil {
 		return nil, err
@@ -76,7 +75,7 @@ func GenKeypair(algorithm string) (*Keypair, error) {
 
 	privBytes := priv.([]byte)
 	pubBytes := pub.([]byte)
-	return &Keypair{
+	return &KeyPair{
 		Priv:      hex.EncodeToString(privBytes),
 		Pub:       hex.EncodeToString(pubBytes),
 		Algorithm: algo,
@@ -85,16 +84,16 @@ func GenKeypair(algorithm string) (*Keypair, error) {
 	}, err
 }
 
-func (k *Keypair) MarshalJSON() ([]byte, error) {
+func (k *KeyPair) MarshalJSON() ([]byte, error) {
 	k.Pub = hex.EncodeToString(k.pubBytes)
 	k.Priv = hex.EncodeToString(k.privBytes)
-	type alias Keypair
+	type alias KeyPair
 	aliasKeypair := (*alias)(k)
 	return json.Marshal(aliasKeypair)
 }
 
-func (k *Keypair) UnmarshalJSON(data []byte) error {
-	type alias Keypair
+func (k *KeyPair) UnmarshalJSON(data []byte) error {
+	type alias KeyPair
 	aliasKeypair := (*alias)(k)
 	if err := json.Unmarshal(data, aliasKeypair); err != nil {
 		return err
@@ -108,7 +107,7 @@ func (k *Keypair) UnmarshalJSON(data []byte) error {
 	return err
 }
 
-func (k *Keypair) Taint() error {
+func (k *KeyPair) Taint() error {
 	if k.Tainted {
 		return ErrPubKeyAlreadyTainted
 	}
@@ -117,7 +116,7 @@ func (k *Keypair) Taint() error {
 	return nil
 }
 
-func (k *Keypair) Sign(marshalledData []byte) (*commandspb.Signature, error) {
+func (k *KeyPair) Sign(marshalledData []byte) (*commandspb.Signature, error) {
 	sig, err := k.Algorithm.Sign(k.privBytes, marshalledData)
 	if err != nil {
 		return nil, err
@@ -130,10 +129,24 @@ func (k *Keypair) Sign(marshalledData []byte) (*commandspb.Signature, error) {
 	}, nil
 }
 
-// SecureCopy ensures the sensitive information doesn't leak outside.
-func (k *Keypair) SecureCopy() Keypair {
+func (k *KeyPair) DeepCopy() KeyPair {
 	copiedK := *k
-	copiedK.Priv = ""
-	copiedK.privBytes = []byte{}
 	return copiedK
 }
+
+// ToPublicKey ensures the sensitive information doesn't leak outside.
+func (k *KeyPair) ToPublicKey() *PublicKey {
+	return &PublicKey{
+		Key:       k.Pub,
+		Algorithm: k.Algorithm,
+		Tainted:   k.Tainted,
+		Meta:      k.Meta,
+	}
+}
+
+type PublicKey struct {
+	Key       string                    `json:"pub"`
+	Algorithm crypto.SignatureAlgorithm `json:"algo"`
+	Tainted   bool                      `json:"tainted"`
+	Meta      []Meta                    `json:"meta"`
+}
diff --git a/wallet/rsa.go b/wallet/rsa.go
new file mode 100644
index 0000000..fb5b7d0
--- /dev/null
+++ b/wallet/rsa.go
@@ -0,0 +1,69 @@
+package wallet
+
+import (
+	"bytes"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+)
+
+type RSAKeys struct {
+	Pub  []byte
+	Priv []byte
+}
+
+func GenerateRSAKeys() (*RSAKeys, error) {
+	bitSize := 4096
+
+	key, err := rsa.GenerateKey(rand.Reader, bitSize)
+	if err != nil {
+		return nil, fmt.Errorf("unable to generate rsa keys: %v", err)
+	}
+
+	privateKey, err := toPrivatePKCS1Key(key)
+	if err != nil {
+		return nil, err
+	}
+
+	publicKey, err := toPublicPKCS1Key(key)
+	if err != nil {
+		return nil, err
+	}
+
+	return &RSAKeys{
+		Pub:  publicKey,
+		Priv: privateKey,
+	}, nil
+}
+
+func toPrivatePKCS1Key(key *rsa.PrivateKey) ([]byte, error) {
+	privateKey := &pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(key),
+	}
+	privateKeyBuffer := bytes.NewBuffer([]byte{})
+	err := pem.Encode(privateKeyBuffer, privateKey)
+	if err != nil {
+		return nil, err
+	}
+	return privateKeyBuffer.Bytes(), nil
+}
+
+func toPublicPKCS1Key(key *rsa.PrivateKey) ([]byte, error) {
+	pubBytes, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
+	if err != nil {
+		return nil, err
+	}
+	publicKey := &pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: pubBytes,
+	}
+	publicKeyBuffer := bytes.NewBuffer([]byte{})
+	err = pem.Encode(publicKeyBuffer, publicKey)
+	if err != nil {
+		return nil, err
+	}
+	return publicKeyBuffer.Bytes(), nil
+}
diff --git a/wallet/wallet.go b/wallet/wallet.go
index c6e53d5..501b4b5 100644
--- a/wallet/wallet.go
+++ b/wallet/wallet.go
@@ -1,18 +1,8 @@
 package wallet
 
-import (
-	"encoding/json"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"code.vegaprotocol.io/go-wallet/fsutil"
-	"code.vegaprotocol.io/go-wallet/wallet/crypto"
-)
-
 type Wallet struct {
-	Owner    string
-	Keypairs KeyRing
+	Owner   string
+	KeyRing KeyRing `json:"Keypairs"`
 }
 
 func NewWallet(name string) *Wallet {
@@ -28,119 +18,9 @@ type Meta struct {
 
 func New(owner string) Wallet {
 	return Wallet{
-		Owner:    owner,
-		Keypairs: NewKeyRing(),
-	}
-}
-
-func EnsureBaseFolder(root string) error {
-	return fsutil.EnsureDir(filepath.Join(root, walletBaseFolder))
-}
-
-func WalletFileExists(root, file string) bool {
-	if ok, _ := fsutil.PathExists(filepath.Join(root, walletBaseFolder, file)); ok {
-		return true
-	}
-	return false
-}
-
-func CreateWalletFile(walletpath, owner, passphrase string) (*Wallet, error) {
-	w := Wallet{
-		Owner: owner,
-	}
-	// make sure this do not exists already
-	if ok, _ := fsutil.PathExists(walletpath); ok {
-		return nil, ErrWalletAlreadyExists
-	}
-
-	return WriteWalletFile(&w, walletpath, passphrase)
-}
-
-func Create(root, owner, passphrase string) (*Wallet, error) {
-	// build walletpath
-	walletpath := filepath.Join(root, walletBaseFolder, owner)
-	return CreateWalletFile(walletpath, owner, passphrase)
-}
-
-func AddKeypair(kp *Keypair, root, owner, passphrase string) (*Wallet, error) {
-	w, err := Read(root, owner, passphrase)
-	if err != nil {
-		return nil, err
-	}
-
-	w.Keypairs = append(w.Keypairs, *kp)
-
-	return writeWallet(w, root, owner, passphrase)
-}
-
-func ReadWalletFile(walletpath, passphrase string) (*Wallet, error) {
-	// make sure this do not exists already
-	if ok, _ := fsutil.PathExists(walletpath); !ok {
-		return nil, ErrWalletDoesNotExists
+		Owner:   owner,
+		KeyRing: NewKeyRing(),
 	}
-
-	// read file
-	buf, err := ioutil.ReadFile(walletpath)
-	if err != nil {
-		return nil, err
-	}
-
-	// decrypt the buffer
-	decBuf, err := crypto.Decrypt(buf, passphrase)
-	if err != nil {
-		return nil, err
-	}
-
-	// unmarshal the wallet now an return
-	w := &Wallet{}
-	return w, json.Unmarshal(decBuf, w)
-}
-
-func Read(root, owner, passphrase string) (*Wallet, error) {
-	// build walletpath
-	walletpath := filepath.Join(root, walletBaseFolder, owner)
-
-	return ReadWalletFile(walletpath, passphrase)
-}
-
-func Write(w *Wallet, root, owner, passphrase string) (*Wallet, error) {
-	return writeWallet(w, root, owner, passphrase)
-}
-
-func WriteWalletFile(w *Wallet, walletpath, passphrase string) (*Wallet, error) {
-	// marshal our wallet
-	buf, err := json.Marshal(w)
-	if err != nil {
-		return nil, err
-	}
-
-	// encrypt our data
-	encBuf, err := crypto.Encrypt(buf, passphrase)
-	if err != nil {
-		return nil, err
-	}
-
-	// create and write file
-	f, err := os.Create(walletpath)
-	if err != nil {
-		return nil, err
-	}
-	f.Write(encBuf)
-	f.Close()
-
-	return w, nil
 }
 
-func writeWallet(w *Wallet, root, owner, passphrase string) (*Wallet, error) {
-	// build walletpath
-	walletpath := filepath.Join(root, walletBaseFolder, owner)
-	return WriteWalletFile(w, walletpath, passphrase)
-}
 
-func Sign(alg crypto.SignatureAlgorithm, kp *Keypair, message []byte) ([]byte, error) {
-	return alg.Sign(kp.privBytes, message)
-}
-
-func Verify(alg crypto.SignatureAlgorithm, kp *Keypair, message []byte, sig []byte) (bool, error) {
-	return alg.Verify(kp.pubBytes, message, sig)
-}


Test patch:
diff --git a/config/config_test.go b/config/config_test.go
new file mode 100644
index 0000000..df06eb0
--- /dev/null
+++ b/config/config_test.go
@@ -0,0 +1,155 @@
+package config_test
+
+import (
+	"errors"
+	"testing"
+
+	"code.vegaprotocol.io/go-wallet/config"
+	"code.vegaprotocol.io/go-wallet/config/mocks"
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+)
+
+type testService struct {
+	ctrl  *gomock.Controller
+	log   *zap.Logger
+	store *mocks.MockStore
+}
+
+func getTestService(t *testing.T) *testService {
+	ctrl := gomock.NewController(t)
+	store := mocks.NewMockStore(ctrl)
+
+	return &testService{
+		ctrl:  ctrl,
+		log:   zap.NewNop(),
+		store: store,
+	}
+}
+
+func TestGenerateConfig(t *testing.T) {
+	t.Run("Generating config succeeds", testGeneratingConfigSucceeds)
+	t.Run("Generating config with error fails", testGeneratingConfigWithErrorFails)
+	t.Run("Generating config with RSA keys generation succeeds", testGeneratingConfigWithRSAKeysSucceeds)
+	t.Run("Generating config with RSA keys generation with error fails", testGeneratingConfigWithRSAKeysWithErrorFails)
+	t.Run("Overwriting config succeeds", testOverwritingConfigSucceeds)
+	t.Run("Overwriting config with RSA keys generation succeeds", testOverwritingConfigWithRSAKeysSucceeds)
+}
+
+func testGeneratingConfigSucceeds(t *testing.T) {
+	ts := getTestService(t)
+
+	// setup
+	ts.store.EXPECT().
+		SaveConfig(gomock.Any(), false).
+		Times(1).
+		Return(nil)
+	ts.store.EXPECT().
+		SaveRSAKeys(gomock.Any(), gomock.Any()).
+		Times(0)
+
+	// when
+	err := config.GenerateConfig(ts.log, ts.store, false, false)
+
+	// then
+	require.NoError(t, err)
+}
+
+func testGeneratingConfigWithErrorFails(t *testing.T) {
+	ts := getTestService(t)
+
+	// setup
+	ts.store.EXPECT().
+		SaveConfig(gomock.Any(), false).
+		Times(1).
+		Return(errors.New("some error"))
+	ts.store.EXPECT().
+		SaveRSAKeys(gomock.Any(), gomock.Any()).
+		Times(0)
+
+	// when
+	err := config.GenerateConfig(ts.log, ts.store, false, false)
+
+	// then
+	require.Error(t, err, errors.New("some error"))
+}
+
+func testGeneratingConfigWithRSAKeysSucceeds(t *testing.T) {
+	ts := getTestService(t)
+
+	// setup
+	ts.store.EXPECT().
+		SaveConfig(gomock.Any(), false).
+		Times(1).
+		Return(nil)
+	ts.store.EXPECT().
+		SaveRSAKeys(gomock.Any(), false).
+		Times(1).
+		Return(nil)
+
+	// when
+	err := config.GenerateConfig(ts.log, ts.store, false, true)
+
+	// then
+	require.NoError(t, err)
+}
+
+func testGeneratingConfigWithRSAKeysWithErrorFails(t *testing.T) {
+	ts := getTestService(t)
+
+	// setup
+	ts.store.EXPECT().
+		SaveConfig(gomock.Any(), false).
+		Times(1).
+		Return(nil)
+	ts.store.EXPECT().
+		SaveRSAKeys(gomock.Any(), false).
+		Times(1).
+		Return(errors.New("some error"))
+
+	// when
+	err := config.GenerateConfig(ts.log, ts.store, false, true)
+
+	// then
+	require.Error(t, err, errors.New("some error"))
+}
+
+func testOverwritingConfigSucceeds(t *testing.T) {
+	ts := getTestService(t)
+
+	// setup
+	ts.store.EXPECT().
+		SaveConfig(gomock.Any(), true).
+		Times(1).
+		Return(nil)
+	ts.store.EXPECT().
+		SaveRSAKeys(gomock.Any(), gomock.Any()).
+		Times(0)
+
+	// when
+	err := config.GenerateConfig(ts.log, ts.store, true, false)
+
+	// then
+	require.NoError(t, err)
+}
+
+func testOverwritingConfigWithRSAKeysSucceeds(t *testing.T) {
+	ts := getTestService(t)
+
+	// setup
+	ts.store.EXPECT().
+		SaveConfig(gomock.Any(), true).
+		Times(1).
+		Return(nil)
+	ts.store.EXPECT().
+		SaveRSAKeys(gomock.Any(), true).
+		Times(1).
+		Return(nil)
+
+	// when
+	err := config.GenerateConfig(ts.log, ts.store, true, true)
+
+	// then
+	require.NoError(t, err)
+}
diff --git a/wallet/auth_test.go b/service/auth_test.go
similarity index 71%
rename from wallet/auth_test.go
rename to service/auth_test.go
index 0458d19..7c3d48c 100644
--- a/wallet/auth_test.go
+++ b/service/auth_test.go
@@ -1,41 +1,42 @@
-package wallet_test
+package service_test
 
 import (
-	"os"
 	"testing"
 	"time"
 
-	"code.vegaprotocol.io/go-wallet/fsutil"
+	"code.vegaprotocol.io/go-wallet/service"
+	"code.vegaprotocol.io/go-wallet/service/mocks"
 	"code.vegaprotocol.io/go-wallet/wallet"
-
+	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"go.uber.org/zap"
 )
 
 type testAuth struct {
-	wallet.Auth
+	service.Auth
 	rootPath string
+	ctrl     *gomock.Controller
 }
 
 func getTestAuth(t *testing.T) *testAuth {
-	rootPath := rootDir()
-	tokenExpiry := 10 * time.Hour
-	fsutil.EnsureDir(rootPath)
-	log := zap.NewNop()
-
-	// gen keys
-	err := wallet.GenRsaKeyFiles(log, rootPath, false)
+	rsaKeys, err := wallet.GenerateRSAKeys()
 	if err != nil {
 		t.Fatal(err)
 	}
-	a, err := wallet.NewAuth(log, rootPath, tokenExpiry)
+
+	ctrl := gomock.NewController(t)
+	store := mocks.NewMockRSAStore(ctrl)
+	store.EXPECT().GetRsaKeys().Return(rsaKeys, nil)
+
+	tokenExpiry := 10 * time.Hour
+	a, err := service.NewAuth(zap.NewNop(), store, tokenExpiry)
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	return &testAuth{
-		Auth:     a,
-		rootPath: rootPath,
+		Auth: a,
+		ctrl: ctrl,
 	}
 }
 
@@ -48,29 +49,25 @@ func TestAuth(t *testing.T) {
 
 func testVerifyValidToken(t *testing.T) {
 	auth := getTestAuth(t)
-	wallet := "jeremy"
+	w := "jeremy"
 
 	// get a new session
-	tok, err := auth.NewSession(wallet)
+	tok, err := auth.NewSession(w)
 	assert.NoError(t, err)
 	assert.NotEmpty(t, tok)
 
 	wallet2, err := auth.VerifyToken(tok)
 	assert.NoError(t, err)
-	assert.Equal(t, wallet, wallet2)
-
-	assert.NoError(t, os.RemoveAll(auth.rootPath))
+	assert.Equal(t, w, wallet2)
 }
 
 func testVerifyInvalidToken(t *testing.T) {
 	auth := getTestAuth(t)
-	tok := "hehehe that's not a toekn"
+	tok := "that's not a token"
 
 	w, err := auth.VerifyToken(tok)
 	assert.EqualError(t, err, "token is malformed: token contains an invalid number of segments")
 	assert.Empty(t, w)
-
-	assert.NoError(t, os.RemoveAll(auth.rootPath))
 }
 
 func testRevokeValidToken(t *testing.T) {
@@ -91,10 +88,8 @@ func testRevokeValidToken(t *testing.T) {
 	assert.NoError(t, err)
 
 	w, err := auth.VerifyToken(tok)
-	assert.EqualError(t, err, wallet.ErrSessionNotFound.Error())
+	assert.EqualError(t, err, service.ErrSessionNotFound.Error())
 	assert.Empty(t, w)
-
-	assert.NoError(t, os.RemoveAll(auth.rootPath))
 }
 
 func testRevokeInvalidToken(t *testing.T) {
@@ -103,6 +98,4 @@ func testRevokeInvalidToken(t *testing.T) {
 
 	err := auth.Revoke(tok)
 	assert.EqualError(t, err, "token is malformed: token contains an invalid number of segments")
-
-	assert.NoError(t, os.RemoveAll(auth.rootPath))
 }
diff --git a/wallet/service_deprecated_test.go b/service/service_deprecated_test.go
similarity index 82%
rename from wallet/service_deprecated_test.go
rename to service/service_deprecated_test.go
index 6c05b26..254f66f 100644
--- a/wallet/service_deprecated_test.go
+++ b/service/service_deprecated_test.go
@@ -1,4 +1,4 @@
-package wallet_test
+package service_test
 
 import (
 	"bytes"
@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	"code.vegaprotocol.io/go-wallet/service"
 	"code.vegaprotocol.io/go-wallet/wallet"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
@@ -20,7 +21,8 @@ func testServiceSignOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
-	s.handler.EXPECT().SignTx(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
+	s.handler.EXPECT().SignTx("jeremy", gomock.Any(), "asdasasdasd", uint64(42)).
 		Times(1).Return(wallet.SignedBundle{}, nil)
 	s.nodeForward.EXPECT().LastBlockHeight(gomock.Any()).
 		Times(1).Return(uint64(42), nil)
@@ -30,7 +32,7 @@ func testServiceSignOK(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.SignTx)(w, r, nil)
+	service.ExtractToken(s.SignTx)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
@@ -44,7 +46,7 @@ func testServiceSignFailInvalidRequest(t *testing.T) {
 	r := httptest.NewRequest("GET", "scheme://host/path", nil)
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.SignTx)(w, r, nil)
+	service.ExtractToken(s.SignTx)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -55,7 +57,7 @@ func testServiceSignFailInvalidRequest(t *testing.T) {
 
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.SignTx)(w, r, nil)
+	service.ExtractToken(s.SignTx)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -64,7 +66,7 @@ func testServiceSignFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", nil)
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.SignTx)(w, r, nil)
+	service.ExtractToken(s.SignTx)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -75,7 +77,7 @@ func testServiceSignFailInvalidRequest(t *testing.T) {
 	w = httptest.NewRecorder()
 	r.Header.Set("Authorization", "Bearer eyXXzA")
 
-	wallet.ExtractToken(s.SignTx)(w, r, nil)
+	service.ExtractToken(s.SignTx)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -85,7 +87,7 @@ func testServiceSignFailInvalidRequest(t *testing.T) {
 	w = httptest.NewRecorder()
 	r.Header.Set("Authorization", "Bearer eyXXzA")
 
-	wallet.ExtractToken(s.SignTx)(w, r, nil)
+	service.ExtractToken(s.SignTx)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
diff --git a/wallet/service_test.go b/service/service_test.go
similarity index 82%
rename from wallet/service_test.go
rename to service/service_test.go
index 25cd576..3d936fe 100644
--- a/wallet/service_test.go
+++ b/service/service_test.go
@@ -1,4 +1,4 @@
-package wallet_test
+package service_test
 
 import (
 	"bytes"
@@ -10,9 +10,10 @@ import (
 	"os"
 	"testing"
 
+	"code.vegaprotocol.io/go-wallet/service"
+	"code.vegaprotocol.io/go-wallet/service/mocks"
 	"code.vegaprotocol.io/go-wallet/wallet"
 	"code.vegaprotocol.io/go-wallet/wallet/crypto"
-	"code.vegaprotocol.io/go-wallet/wallet/mocks"
 	"github.com/stretchr/testify/require"
 	"github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/api"
 	commandspb "github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/commands/v1"
@@ -26,23 +27,26 @@ import (
 // this tests in general ensure request / response contracts are not broken for the service
 
 type testService struct {
-	*wallet.Service
+	*service.Service
 
 	ctrl        *gomock.Controller
 	handler     *mocks.MockWalletHandler
 	nodeForward *mocks.MockNodeForward
+	auth        *mocks.MockAuth
 }
 
 func getTestService(t *testing.T) *testService {
 	ctrl := gomock.NewController(t)
 	handler := mocks.NewMockWalletHandler(ctrl)
+	auth := mocks.NewMockAuth(ctrl)
 	nodeForward := mocks.NewMockNodeForward(ctrl)
 	// no needs of the conf or path as we do not run an actual service
-	s, _ := wallet.NewServiceWith(zap.NewNop(), nil, handler, nodeForward)
+	s, _ := service.NewServiceWith(zap.NewNop(), nil, handler, auth, nodeForward)
 	return &testService{
 		Service:     s,
 		ctrl:        ctrl,
 		handler:     handler,
+		auth:        auth,
 		nodeForward: nodeForward,
 	}
 }
@@ -81,7 +85,8 @@ func testServiceCreateWalletOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
-	s.handler.EXPECT().CreateWallet(gomock.Any(), gomock.Any()).Times(1).Return("this is a token", nil)
+	s.handler.EXPECT().CreateWallet("jeremy", "oh yea?").Times(1).Return(nil)
+	s.auth.EXPECT().NewSession("jeremy").Times(1).Return("this is a token", nil)
 
 	payload := `{"wallet": "jeremy", "passphrase": "oh yea?"}`
 	r := httptest.NewRequest("POST", "scheme://host/path", bytes.NewBufferString(payload))
@@ -120,7 +125,8 @@ func testServiceLoginWalletOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
-	s.handler.EXPECT().LoginWallet(gomock.Any(), gomock.Any()).Times(1).Return("this is a token", nil)
+	s.handler.EXPECT().LoginWallet(gomock.Any(), gomock.Any()).Times(1).Return(nil)
+	s.auth.EXPECT().NewSession("jeremy").Times(1).Return("this is a token", nil)
 
 	payload := `{"wallet": "jeremy", "passphrase": "oh yea?"}`
 	r := httptest.NewRequest("POST", "scheme://host/path", bytes.NewBufferString(payload))
@@ -136,17 +142,18 @@ func testServiceDownloadWalletOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
-	s.handler.EXPECT().LoginWallet(gomock.Any(), gomock.Any()).Times(1).Return("this is a token", nil)
-
 	payload := `{"wallet": "jeremy", "passphrase": "oh yea?"}`
 	r := httptest.NewRequest("POST", "scheme://host/path", bytes.NewBufferString(payload))
 	w := httptest.NewRecorder()
 
+	s.handler.EXPECT().LoginWallet("jeremy", "oh yea?").Times(1).Return(nil)
+	s.auth.EXPECT().NewSession("jeremy").Times(1).Return("this is a token", nil)
+
 	s.Login(w, r, nil)
 
 	resp := w.Result()
 	var token struct {
-		Data string
+		Token string
 	}
 	assert.Equal(t, resp.StatusCode, http.StatusOK)
 	raw, _ := ioutil.ReadAll(resp.Body)
@@ -159,13 +166,15 @@ func testServiceDownloadWalletOK(t *testing.T) {
 		tmpFile.Close()
 		os.Remove(name)
 	}()
-	s.handler.EXPECT().GetWalletPath(token.Data).Times(1).Return(tmpFile.Name(), nil)
+
+	s.auth.EXPECT().VerifyToken("this is a token").Times(1).Return("jeremy", nil)
+	s.handler.EXPECT().GetWalletPath("jeremy").Times(1).Return(tmpFile.Name(), nil)
 
 	// now get the file:
 	r = httptest.NewRequest(http.MethodGet, "scheme://host/path", bytes.NewBufferString(""))
 	w = httptest.NewRecorder()
 
-	s.DownloadWallet(token.Data, w, r, nil)
+	s.DownloadWallet(token.Token, w, r, nil)
 	resp = w.Result()
 
 	assert.Equal(t, resp.StatusCode, http.StatusOK)
@@ -179,6 +188,9 @@ func testServiceLoginWalletFailInvalidRequest(t *testing.T) {
 	r := httptest.NewRequest("POST", "scheme://host/path", bytes.NewBufferString(payload))
 	w := httptest.NewRecorder()
 
+	s.handler.EXPECT().LoginWallet(gomock.Any(), gomock.Any()).Times(0)
+	s.auth.EXPECT().NewSession(gomock.Any()).Times(0)
+
 	s.Login(w, r, nil)
 
 	resp := w.Result()
@@ -188,6 +200,9 @@ func testServiceLoginWalletFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", bytes.NewBufferString(payload))
 	w = httptest.NewRecorder()
 
+	s.handler.EXPECT().LoginWallet(gomock.Any(), gomock.Any()).Times(0)
+	s.auth.EXPECT().NewSession(gomock.Any()).Times(0)
+
 	s.Login(w, r, nil)
 
 	resp = w.Result()
@@ -198,14 +213,14 @@ func testServiceRevokeTokenOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
-	s.handler.EXPECT().RevokeToken(gomock.Any()).Times(1).Return(nil)
+	s.auth.EXPECT().Revoke(gomock.Any()).Times(1).Return(nil)
 
 	r := httptest.NewRequest("POST", "scheme://host/path", nil)
 	r.Header.Add("Authorization", "Bearer eyXXzA")
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.Revoke)(w, r, nil)
+	service.ExtractToken(s.Revoke)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
@@ -221,7 +236,7 @@ func testServiceRevokeTokenFailInvalidRequest(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.Revoke)(w, r, nil)
+	service.ExtractToken(s.Revoke)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -230,7 +245,7 @@ func testServiceRevokeTokenFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", nil)
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.Revoke)(w, r, nil)
+	service.ExtractToken(s.Revoke)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -240,8 +255,9 @@ func testServiceGenKeypairOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
-	s.handler.EXPECT().GenerateKeypair(gomock.Any(), gomock.Any()).Times(1).Return("", nil)
-	s.handler.EXPECT().GetPublicKey(gomock.Any(), gomock.Any()).Times(1).Return(&wallet.Keypair{}, nil)
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
+	s.handler.EXPECT().SecureGenerateKeyPair(gomock.Any(), gomock.Any()).Times(1).Return("", nil)
+	s.handler.EXPECT().GetPublicKey(gomock.Any(), gomock.Any()).Times(1).Return(&wallet.PublicKey{}, nil)
 
 	payload := `{"passphrase": "oh yea?"}`
 	r := httptest.NewRequest("POST", "scheme://host/path", bytes.NewBufferString(payload))
@@ -249,7 +265,7 @@ func testServiceGenKeypairOK(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GenerateKeypair)(w, r, nil)
+	service.ExtractToken(s.GenerateKeypair)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
@@ -265,7 +281,7 @@ func testServiceGenKeypairFailInvalidRequest(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GenerateKeypair)(w, r, nil)
+	service.ExtractToken(s.GenerateKeypair)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -274,7 +290,7 @@ func testServiceGenKeypairFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", nil)
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GenerateKeypair)(w, r, nil)
+	service.ExtractToken(s.GenerateKeypair)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -284,7 +300,7 @@ func testServiceGenKeypairFailInvalidRequest(t *testing.T) {
 	w = httptest.NewRecorder()
 	r.Header.Add("Authorization", "Bearer eyXXzA")
 
-	wallet.ExtractToken(s.GenerateKeypair)(w, r, nil)
+	service.ExtractToken(s.GenerateKeypair)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -295,15 +311,16 @@ func testServiceListPublicKeysOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
 	s.handler.EXPECT().ListPublicKeys(gomock.Any()).Times(1).
-		Return([]wallet.Keypair{}, nil)
+		Return([]wallet.PublicKey{}, nil)
 
 	r := httptest.NewRequest("GET", "scheme://host/path", nil)
 	r.Header.Add("Authorization", "Bearer eyXXzA")
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.ListPublicKeys)(w, r, nil)
+	service.ExtractToken(s.ListPublicKeys)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
@@ -319,7 +336,7 @@ func testServiceListPublicKeysFailInvalidRequest(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.ListPublicKeys)(w, r, nil)
+	service.ExtractToken(s.ListPublicKeys)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -328,7 +345,7 @@ func testServiceListPublicKeysFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", nil)
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.ListPublicKeys)(w, r, nil)
+	service.ExtractToken(s.ListPublicKeys)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -338,7 +355,8 @@ func testServiceGetPublicKeyOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
-	kp := wallet.Keypair{
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
+	kp := wallet.KeyPair{
 		Pub:       "pub",
 		Priv:      "",
 		Algorithm: crypto.NewEd25519(),
@@ -346,14 +364,14 @@ func testServiceGetPublicKeyOK(t *testing.T) {
 		Meta:      []wallet.Meta{{Key: "a", Value: "b"}},
 	}
 	s.handler.EXPECT().GetPublicKey(gomock.Any(), gomock.Any()).Times(1).
-		Return(&kp, nil)
+		Return(kp.ToPublicKey(), nil)
 
 	r := httptest.NewRequest("GET", "scheme://host/path", nil)
 	r.Header.Add("Authorization", "Bearer eyXXzA")
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GetPublicKey)(w, r, httprouter.Params{{Key: "keyid", Value: "apubkey"}})
+	service.ExtractToken(s.GetPublicKey)(w, r, httprouter.Params{{Key: "keyid", Value: "apubkey"}})
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
@@ -369,7 +387,7 @@ func testServiceGetPublicKeyFailInvalidRequest(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GetPublicKey)(w, r, nil)
+	service.ExtractToken(s.GetPublicKey)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -378,7 +396,7 @@ func testServiceGetPublicKeyFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", nil)
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GetPublicKey)(w, r, nil)
+	service.ExtractToken(s.GetPublicKey)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -388,6 +406,7 @@ func testServiceGetPublicKeyFailKeyNotFound(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
 	s.handler.EXPECT().GetPublicKey(gomock.Any(), gomock.Any()).Times(1).
 		Return(nil, wallet.ErrPubKeyDoesNotExist)
 
@@ -396,7 +415,7 @@ func testServiceGetPublicKeyFailKeyNotFound(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GetPublicKey)(w, r, httprouter.Params{{Key: "keyid", Value: "apubkey"}})
+	service.ExtractToken(s.GetPublicKey)(w, r, httprouter.Params{{Key: "keyid", Value: "apubkey"}})
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
@@ -406,6 +425,7 @@ func testServiceGetPublicKeyFailMiscError(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
 	s.handler.EXPECT().GetPublicKey(gomock.Any(), gomock.Any()).Times(1).
 		Return(nil, errors.New("an error"))
 
@@ -414,7 +434,7 @@ func testServiceGetPublicKeyFailMiscError(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.GetPublicKey)(w, r, httprouter.Params{{Key: "keyid", Value: "apubkey"}})
+	service.ExtractToken(s.GetPublicKey)(w, r, httprouter.Params{{Key: "keyid", Value: "apubkey"}})
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
@@ -424,6 +444,7 @@ func testServiceTaintOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
 	s.handler.EXPECT().TaintKey(gomock.Any(), gomock.Any(), gomock.Any()).
 		Times(1).Return(nil)
 	payload := `{"passphrase": "some data"}`
@@ -432,7 +453,7 @@ func testServiceTaintOK(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.TaintKey)(w, r, httprouter.Params{{Key: "keyid", Value: "asdasasdasd"}})
+	service.ExtractToken(s.TaintKey)(w, r, httprouter.Params{{Key: "keyid", Value: "asdasasdasd"}})
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
@@ -448,7 +469,7 @@ func testServiceTaintFailInvalidRequest(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.TaintKey)(w, r, nil)
+	service.ExtractToken(s.TaintKey)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -457,7 +478,7 @@ func testServiceTaintFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", nil)
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.TaintKey)(w, r, nil)
+	service.ExtractToken(s.TaintKey)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -468,7 +489,7 @@ func testServiceTaintFailInvalidRequest(t *testing.T) {
 	w = httptest.NewRecorder()
 	r.Header.Set("Authorization", "Bearer eyXXzA")
 
-	wallet.ExtractToken(s.TaintKey)(w, r, nil)
+	service.ExtractToken(s.TaintKey)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -478,7 +499,7 @@ func testServiceTaintFailInvalidRequest(t *testing.T) {
 	w = httptest.NewRecorder()
 	r.Header.Set("Authorization", "Bearer eyXXzA")
 
-	wallet.ExtractToken(s.TaintKey)(w, r, nil)
+	service.ExtractToken(s.TaintKey)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -489,6 +510,7 @@ func testServiceUpdateMetaOK(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
 	s.handler.EXPECT().UpdateMeta(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
 		Times(1).Return(nil)
 	payload := `{"passphrase": "some data", "meta": [{"key":"ok", "value":"primary"}]}`
@@ -497,7 +519,7 @@ func testServiceUpdateMetaOK(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.UpdateMeta)(w, r, httprouter.Params{{Key: "keyid", Value: "asdasasdasd"}})
+	service.ExtractToken(s.UpdateMeta)(w, r, httprouter.Params{{Key: "keyid", Value: "asdasasdasd"}})
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
@@ -513,7 +535,7 @@ func testServiceUpdateMetaFailInvalidRequest(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.UpdateMeta)(w, r, nil)
+	service.ExtractToken(s.UpdateMeta)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -522,7 +544,7 @@ func testServiceUpdateMetaFailInvalidRequest(t *testing.T) {
 	r = httptest.NewRequest("POST", "scheme://host/path", nil)
 	w = httptest.NewRecorder()
 
-	wallet.ExtractToken(s.UpdateMeta)(w, r, nil)
+	service.ExtractToken(s.UpdateMeta)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -533,7 +555,7 @@ func testServiceUpdateMetaFailInvalidRequest(t *testing.T) {
 	w = httptest.NewRecorder()
 	r.Header.Set("Authorization", "Bearer eyXXzA")
 
-	wallet.ExtractToken(s.UpdateMeta)(w, r, nil)
+	service.ExtractToken(s.UpdateMeta)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -543,7 +565,7 @@ func testServiceUpdateMetaFailInvalidRequest(t *testing.T) {
 	w = httptest.NewRecorder()
 	r.Header.Set("Authorization", "Bearer eyXXzA")
 
-	wallet.ExtractToken(s.UpdateMeta)(w, r, nil)
+	service.ExtractToken(s.UpdateMeta)(w, r, nil)
 
 	resp = w.Result()
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
@@ -556,13 +578,18 @@ func testSigningTransactionSucceeds(t *testing.T) {
 
 	// given
 	token := "eyXXzA"
+	name := "jeremy"
 	payload := `{"pubKey": "0xCAFEDUDE", "orderCancellation": {}}`
 	request := newAuthenticatedRequest(payload)
 	response := httptest.NewRecorder()
 
 	// setup
+	s.auth.EXPECT().
+		VerifyToken(token).
+		Times(1).
+		Return(name, nil)
 	s.handler.EXPECT().
-		SignTxV2(token, gomock.Any(), gomock.Any()).
+		SignTxV2(name, gomock.Any(), gomock.Any()).
 		Times(1).
 		Return(&commandspb.Transaction{}, nil)
 	s.nodeForward.EXPECT().
@@ -585,13 +612,18 @@ func testSigningTransactionWithPropagationSucceeds(t *testing.T) {
 
 	// given
 	token := "eyXXzA"
+	name := "jeremy"
 	payload := `{"propagate": true, "pubKey": "0xCAFEDUDE", "orderCancellation": {}}`
 	request := newAuthenticatedRequest(payload)
 	response := httptest.NewRecorder()
 
 	// setup
+	s.auth.EXPECT().
+		VerifyToken(token).
+		Times(1).
+		Return(name, nil)
 	s.handler.EXPECT().
-		SignTxV2(token, gomock.Any(), gomock.Any()).
+		SignTxV2(name, gomock.Any(), gomock.Any()).
 		Times(1).
 		Return(&commandspb.Transaction{}, nil)
 	s.nodeForward.EXPECT().
@@ -615,13 +647,18 @@ func testSigningTransactionWithFailedPropagationFails(t *testing.T) {
 
 	// given
 	token := "eyXXzA"
+	name := "jeremy"
 	payload := `{"propagate": true, "pubKey": "0xCAFEDUDE", "orderCancellation": {}}`
 	request := newAuthenticatedRequest(payload)
 	response := httptest.NewRecorder()
 
 	// setup
+	s.auth.EXPECT().
+		VerifyToken(token).
+		Times(1).
+		Return(name, nil)
 	s.handler.EXPECT().
-		SignTxV2(token, gomock.Any(), gomock.Any()).
+		SignTxV2(name, gomock.Any(), gomock.Any()).
 		Times(1).
 		Return(&commandspb.Transaction{}, nil)
 	s.nodeForward.EXPECT().
@@ -645,13 +682,18 @@ func testFailedSigningTransactionFails(t *testing.T) {
 
 	// given
 	token := "eyXXzA"
+	name := "jeremy"
 	payload := `{"pubKey": "0xCAFEDUDE", "orderCancellation": {}}`
 	request := newAuthenticatedRequest(payload)
 	response := httptest.NewRecorder()
 
 	// setup
+	s.auth.EXPECT().
+		VerifyToken(token).
+		Times(1).
+		Return(name, nil)
 	s.handler.EXPECT().
-		SignTxV2(token, gomock.Any(), gomock.Any()).
+		SignTxV2(name, gomock.Any(), gomock.Any()).
 		Times(1).
 		Return(nil, errors.New("failure"))
 	s.nodeForward.EXPECT().LastBlockHeight(gomock.Any()).
@@ -723,6 +765,7 @@ func testSigningAnythingSucceeds(t *testing.T) {
 	s := getTestService(t)
 	defer s.ctrl.Finish()
 
+	s.auth.EXPECT().VerifyToken("eyXXzA").Times(1).Return("jeremy", nil)
 	s.handler.EXPECT().SignAny(gomock.Any(), gomock.Any(), gomock.Any()).
 		Times(1).Return([]byte("some sig"), nil)
 	payload := `{"inputData": "some data", "pubKey": "asdasasdasd"}`
@@ -731,7 +774,7 @@ func testSigningAnythingSucceeds(t *testing.T) {
 
 	w := httptest.NewRecorder()
 
-	wallet.ExtractToken(s.SignAny)(w, r, nil)
+	service.ExtractToken(s.SignAny)(w, r, nil)
 
 	resp := w.Result()
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
diff --git a/wallet/file_v1_store_helper_test.go b/store/v1/store_helper_for_test.go
similarity index 51%
rename from wallet/file_v1_store_helper_test.go
rename to store/v1/store_helper_for_test.go
index d3d4784..57e4ff6 100644
--- a/wallet/file_v1_store_helper_test.go
+++ b/store/v1/store_helper_for_test.go
@@ -1,4 +1,4 @@
-package wallet_test
+package v1_test
 
 import (
 	"io/ioutil"
@@ -8,37 +8,32 @@ import (
 	"code.vegaprotocol.io/go-wallet/crypto"
 )
 
-func rootDir() string {
-	path := filepath.Join(rootDirPath, crypto.RandomStr(10))
-	err := os.MkdirAll(path, os.ModePerm)
-	if err != nil {
-		panic(err)
-	}
-	return path
-}
-
 type configDir struct {
-	path string
+	rootPath string
 }
 
 func newConfigDir() configDir {
-	path := filepath.Join("/tmp/vegatests/wallet/", crypto.RandomStr(10))
+	rootPath := filepath.Join("tmp", "vegatests", "wallet", crypto.RandomStr(10))
 
 	return configDir{
-		path: path,
+		rootPath: rootPath,
 	}
 }
 
 func (d configDir) RootPath() string {
-	return d.path
+	return d.rootPath
+}
+
+func (d configDir) RSAKeysPath() string {
+	return filepath.Join(d.rootPath, "wallet_rsa")
 }
 
 func (d configDir) WalletsPath() string {
-	return filepath.Join(d.path, "wallets")
+	return filepath.Join(d.rootPath, "wallets")
 }
 
 func (d configDir) WalletPath(name string) string {
-	return filepath.Join(d.path, "wallets", name)
+	return filepath.Join(d.rootPath, "wallets", name)
 }
 
 func (d configDir) WalletContent(name string) string {
@@ -49,15 +44,8 @@ func (d configDir) WalletContent(name string) string {
 	return string(buf)
 }
 
-func (d configDir) Create() {
-	err := os.MkdirAll(d.path, os.ModePerm)
-	if err != nil {
-		panic(err)
-	}
-}
-
 func (d configDir) Remove() {
-	err := os.RemoveAll(d.path)
+	err := os.RemoveAll(d.rootPath)
 	if err != nil {
 		panic(err)
 	}
diff --git a/store/v1/store_test.go b/store/v1/store_test.go
new file mode 100644
index 0000000..ed09514
--- /dev/null
+++ b/store/v1/store_test.go
@@ -0,0 +1,531 @@
+package v1_test
+
+import (
+	"os"
+	"testing"
+
+	"code.vegaprotocol.io/go-wallet/config"
+	storev1 "code.vegaprotocol.io/go-wallet/store/v1"
+	"code.vegaprotocol.io/go-wallet/wallet"
+	"code.vegaprotocol.io/go-wallet/wallet/crypto"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFileStoreV1(t *testing.T) {
+	t.Run("New store succeeds", testNewStoreSucceeds)
+	t.Run("Initialising new store succeeds", testInitialisingNewStoreSucceeds)
+	t.Run("Saving wallet succeeds", testFileStoreV1SaveWalletSucceeds)
+	t.Run("Getting wallet succeeds", testFileStoreV1GetWalletSucceeds)
+	t.Run("Getting wallet without wrong passphrase fails", testFileStoreV1GetWalletWithWrongPassphraseFails)
+	t.Run("Getting non-existing wallet fails", testFileStoreV1GetNonExistingWalletFails)
+	t.Run("Getting wallet path succeeds", testFileStoreV1GetWalletPathSucceeds)
+	t.Run("Verifying non-existing wallet fails", testFileStoreV1NonExistingWalletFails)
+	t.Run("Verifying existing wallet succeeds", testFileStoreV1ExistingWalletSucceeds)
+	t.Run("Saving already existing config fails", testFileStoreV1SavingAlreadyExistingConfigFails)
+	t.Run("Saving new config  succeeds", testFileStoreV1SavingNewConfigSucceeds)
+	t.Run("Overwriting existing config succeeds", testFileStoreV1OverwritingExistingConfigSucceeds)
+	t.Run("Overwriting non-existing config succeeds", testFileStoreV1OverwritingNonExistingConfigSucceeds)
+	t.Run("Getting non-existing config fails", testFileStoreV1GetNonExistingConfigFails)
+	t.Run("Getting config succeeds", testFileStoreV1GetConfigSucceeds)
+	t.Run("Saving RSA keys without folder fails", testFileStoreV1SaveRSAKeysWithoutFolderFails)
+	t.Run("Saving RSA keys already existing RSA keys fails", testFileStoreV1SaveAlreadyExistingRSAKeysFails)
+	t.Run("Saving RSA keys succeeds", testFileStoreV1SaveRSAKeysSucceeds)
+	t.Run("Overwriting already existing RSA keys succeeds", testFileStoreV1OverwritingAlreadyExistingRSAKeysSucceeds)
+	t.Run("Overwriting non-existing RSA keys succeeds", testFileStoreV1OverwritingNonExistingRSAKeysSucceeds)
+	t.Run("Getting non-existing RSA keys fails", testFileStoreV1GetNonExistingRSAKeysFails)
+	t.Run("Getting existing RSA keys succeeds", testFileStoreV1GetExistingRSAKeysSucceeds)
+}
+
+func testNewStoreSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+
+	s, err := storev1.NewStore(configDir.RootPath())
+
+	require.NoError(t, err)
+	assert.NotNil(t, s)
+}
+
+func testInitialisingNewStoreSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+
+	s, err := storev1.NewStore(configDir.RootPath())
+
+	require.NoError(t, err)
+	assert.NotNil(t, s)
+
+	err = s.Initialise()
+
+	_, err = os.Stat(configDir.WalletsPath())
+	assert.NoError(t, err)
+
+	_, err = os.Stat(configDir.RSAKeysPath())
+	assert.NoError(t, err)
+}
+
+func testFileStoreV1SaveWalletSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	w := newWalletWithKeys()
+
+	// when
+	err := s.SaveWallet(*w, "passphrase")
+
+	// then
+	require.NoError(t, err)
+	assert.NotEmpty(t, configDir.WalletContent(w.Owner))
+}
+
+func testFileStoreV1GetWalletSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	w := *newWalletWithKeys()
+	passphrase := "passphrase"
+
+	// when
+	err := s.SaveWallet(w, passphrase)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedWallet, err := s.GetWallet(w.Owner, passphrase)
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, w, returnedWallet)
+}
+
+func testFileStoreV1GetWalletWithWrongPassphraseFails(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	w := *newWalletWithKeys()
+	passphrase := "passphrase"
+	othPassphrase := "not-original-passphrase"
+
+	// when
+	err := s.SaveWallet(w, passphrase)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedWallet, err := s.GetWallet(w.Owner, othPassphrase)
+
+	// then
+	assert.Error(t, err)
+	assert.Equal(t, wallet.Wallet{}, returnedWallet)
+}
+
+func testFileStoreV1GetNonExistingWalletFails(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	name := "john"
+	passphrase := "passphrase"
+
+	// when
+	returnedWallet, err := s.GetWallet(name, passphrase)
+
+	// then
+	assert.Error(t, err)
+	assert.Equal(t, wallet.Wallet{}, returnedWallet)
+}
+
+func testFileStoreV1GetWalletPathSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	name := "john"
+
+	// when
+	path := s.GetWalletPath(name)
+
+	// then
+	assert.Equal(t, configDir.WalletPath(name), path)
+}
+
+func testFileStoreV1NonExistingWalletFails(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	name := "john"
+
+	// when
+	exists := s.WalletExists(name)
+
+	// then
+	assert.False(t, exists)
+}
+
+func testFileStoreV1ExistingWalletSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	w := *newWalletWithKeys()
+	passphrase := "passphrase"
+
+	// when
+	err := s.SaveWallet(w, passphrase)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	exists := s.WalletExists(w.Owner)
+
+	// then
+	assert.True(t, exists)
+}
+
+func testFileStoreV1SavingAlreadyExistingConfigFails(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	cfg := config.NewDefaultConfig()
+
+	// when
+	err := s.SaveConfig(&cfg, false)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	err = s.SaveConfig(&cfg, false)
+
+	// then
+	require.Error(t, err)
+}
+
+func testFileStoreV1SavingNewConfigSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	cfg := config.NewDefaultConfig()
+
+	// when
+	err := s.SaveConfig(&cfg, false)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedCfg, err := s.GetConfig()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, &cfg, returnedCfg)
+}
+
+func testFileStoreV1OverwritingNonExistingConfigSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	cfg := config.NewDefaultConfig()
+
+	// when
+	err := s.SaveConfig(&cfg, true)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedCfg, err := s.GetConfig()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, &cfg, returnedCfg)
+}
+
+func testFileStoreV1OverwritingExistingConfigSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	cfg := config.NewDefaultConfig()
+
+	// when
+	err := s.SaveConfig(&cfg, false)
+
+	// then
+	require.NoError(t, err)
+
+	// given
+	cfg.Host = "my.new.host.com"
+
+	// when
+	err = s.SaveConfig(&cfg, true)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedCfg, err := s.GetConfig()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, &cfg, returnedCfg)
+}
+
+func testFileStoreV1GetNonExistingConfigFails(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+
+	// when
+	cfg, err := s.GetConfig()
+
+	// then
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+}
+
+func testFileStoreV1GetConfigSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	cfg := config.NewDefaultConfig()
+
+	// when
+	err := s.SaveConfig(&cfg, false)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedCfg, err := s.GetConfig()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, &cfg, returnedCfg)
+}
+
+func testFileStoreV1SaveRSAKeysWithoutFolderFails(t *testing.T) {
+	configDir := newConfigDir()
+
+	// given
+	s := NewStore(configDir)
+	keys := &wallet.RSAKeys{
+		Pub:  []byte("my public key"),
+		Priv: []byte("my private key"),
+	}
+
+	// when
+	err := s.SaveRSAKeys(keys, false)
+
+	// then
+	require.Error(t, err)
+}
+
+func testFileStoreV1SaveAlreadyExistingRSAKeysFails(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	keys := &wallet.RSAKeys{
+		Pub:  []byte("my public key"),
+		Priv: []byte("my private key"),
+	}
+
+	// when
+	err := s.SaveRSAKeys(keys, false)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	err = s.SaveRSAKeys(keys, false)
+
+	// then
+	require.Error(t, err)
+}
+
+func testFileStoreV1SaveRSAKeysSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	keys := &wallet.RSAKeys{
+		Pub:  []byte("my public key"),
+		Priv: []byte("my private key"),
+	}
+
+	// when
+	err := s.SaveRSAKeys(keys, false)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedKeys, err := s.GetRsaKeys()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, keys, returnedKeys)
+}
+
+func testFileStoreV1OverwritingAlreadyExistingRSAKeysSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	keys := &wallet.RSAKeys{
+		Pub:  []byte("my public key"),
+		Priv: []byte("my private key"),
+	}
+
+	// when
+	err := s.SaveRSAKeys(keys, false)
+
+	// then
+	require.NoError(t, err)
+
+	// given
+	newKeys := &wallet.RSAKeys{
+		Pub:  []byte("my public key 2"),
+		Priv: []byte("my private key 2"),
+	}
+
+	// when
+	err = s.SaveRSAKeys(newKeys, true)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedKeys, err := s.GetRsaKeys()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, newKeys, returnedKeys)
+}
+
+func testFileStoreV1OverwritingNonExistingRSAKeysSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	keys := &wallet.RSAKeys{
+		Pub:  []byte("my public key"),
+		Priv: []byte("my private key"),
+	}
+
+	// when
+	err := s.SaveRSAKeys(keys, true)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedKeys, err := s.GetRsaKeys()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, keys, returnedKeys)
+}
+
+func testFileStoreV1GetNonExistingRSAKeysFails(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+
+	// when
+	keys, err := s.GetRsaKeys()
+
+	// then
+	assert.Error(t, err)
+	assert.Nil(t, keys)
+}
+
+func testFileStoreV1GetExistingRSAKeysSucceeds(t *testing.T) {
+	configDir := newConfigDir()
+	defer configDir.Remove()
+
+	// given
+	s := NewInitialisedStore(configDir)
+	keys := &wallet.RSAKeys{
+		Pub:  []byte("my public key"),
+		Priv: []byte("my private key"),
+	}
+
+	// when
+	err := s.SaveRSAKeys(keys, false)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	returnedKeys, err := s.GetRsaKeys()
+
+	// then
+	require.NoError(t, err)
+	assert.Equal(t, keys, returnedKeys)
+}
+
+func NewStore(configDir configDir) *storev1.Store {
+	s, err := storev1.NewStore(configDir.RootPath())
+	if err != nil {
+		panic(err)
+	}
+
+	return s
+}
+
+func NewInitialisedStore(configDir configDir) *storev1.Store {
+	s := NewStore(configDir)
+
+	err := s.Initialise()
+	if err != nil {
+		panic(err)
+	}
+
+	return s
+}
+
+func newWalletWithKeys() *wallet.Wallet {
+	w := wallet.NewWallet("my-wallet")
+
+	kp, err := wallet.GenKeypair(crypto.Ed25519)
+	if err != nil {
+		panic(err)
+	}
+
+	w.KeyRing.Upsert(*kp)
+
+	return w
+}
diff --git a/wallet/file_store_v1_test.go b/wallet/file_store_v1_test.go
deleted file mode 100644
index db66bdc..0000000
--- a/wallet/file_store_v1_test.go
+++ /dev/null
@@ -1,166 +0,0 @@
-package wallet_test
-
-import (
-	"os"
-	"testing"
-
-	"code.vegaprotocol.io/go-wallet/wallet"
-	"code.vegaprotocol.io/go-wallet/wallet/crypto"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestFileStoreV1(t *testing.T) {
-	t.Run("New store without root folder fails", testNewFileStoreV1WithoutRootFolderFails)
-	t.Run("New store with root folder succeeds and create wallet folder", testNewFileStoreV1WithRootFolderSucceeds)
-	t.Run("Saving wallet succeeds", testFileStoreV1SaveWalletSucceeds)
-	t.Run("Getting wallet succeeds", testFileStoreV1GetWalletSucceeds)
-	t.Run("Getting wallet without wrong passphrase fails", testFileStoreV1GetWalletWithWrongPassphraseFails)
-	t.Run("Getting non-existing wallet fails", testFileStoreV1GetNonExistingWalletFails)
-	t.Run("Getting wallet path succeeds", testFileStoreV1GetWalletPathSucceeds)
-}
-
-func testNewFileStoreV1WithoutRootFolderFails(t *testing.T) {
-	configDir := newConfigDir()
-
-	s, err := wallet.NewFileStoreV1(configDir.RootPath())
-
-	require.Error(t, err)
-	assert.Nil(t, s)
-}
-
-func testNewFileStoreV1WithRootFolderSucceeds(t *testing.T) {
-	configDir := newConfigDir()
-	configDir.Create()
-	defer configDir.Remove()
-
-	s, err := wallet.NewFileStoreV1(configDir.RootPath())
-
-	require.NoError(t, err)
-	assert.NotNil(t, s)
-
-	_, err = os.Stat(configDir.WalletsPath())
-	assert.NoError(t, err)
-}
-
-func testFileStoreV1SaveWalletSucceeds(t *testing.T) {
-	configDir := newConfigDir()
-	configDir.Create()
-	defer configDir.Remove()
-
-	// given
-	s := newFileStoreV1(configDir)
-	w := newWalletWithKeys()
-
-	// when
-	err := s.SaveWallet(*w, "passphrase")
-
-	// then
-	require.NoError(t, err)
-	assert.NotEmpty(t, configDir.WalletContent(w.Owner))
-}
-
-func testFileStoreV1GetWalletSucceeds(t *testing.T) {
-	configDir := newConfigDir()
-	configDir.Create()
-	defer configDir.Remove()
-
-	// given
-	s := newFileStoreV1(configDir)
-	w := *newWalletWithKeys()
-	passphrase := "passphrase"
-
-	// when
-	err := s.SaveWallet(w, passphrase)
-
-	// then
-	require.NoError(t, err)
-
-	// when
-	returnedWallet, err := s.GetWallet(w.Owner, passphrase)
-
-	// then
-	require.NoError(t, err)
-	assert.Equal(t, w, returnedWallet)
-}
-
-func testFileStoreV1GetWalletWithWrongPassphraseFails(t *testing.T) {
-	configDir := newConfigDir()
-	configDir.Create()
-	defer configDir.Remove()
-
-	// given
-	s := newFileStoreV1(configDir)
-	w := *newWalletWithKeys()
-	passphrase := "passphrase"
-	othPassphrase := "not-original-passphrase"
-
-	// when
-	err := s.SaveWallet(w, passphrase)
-
-	// then
-	require.NoError(t, err)
-
-	// when
-	returnedWallet, err := s.GetWallet(w.Owner, othPassphrase)
-
-	// then
-	assert.Error(t, err)
-	assert.Equal(t, wallet.Wallet{}, returnedWallet)
-}
-
-func testFileStoreV1GetNonExistingWalletFails(t *testing.T) {
-	configDir := newConfigDir()
-	configDir.Create()
-	defer configDir.Remove()
-
-	// given
-	s := newFileStoreV1(configDir)
-	name := "john"
-	passphrase := "passphrase"
-
-	// when
-	returnedWallet, err := s.GetWallet(name, passphrase)
-
-	// then
-	assert.Error(t, err)
-	assert.Equal(t, wallet.Wallet{}, returnedWallet)
-}
-
-func testFileStoreV1GetWalletPathSucceeds(t *testing.T) {
-	configDir := newConfigDir()
-	configDir.Create()
-	defer configDir.Remove()
-
-	// given
-	s := newFileStoreV1(configDir)
-	name := "john"
-
-	// when
-	path := s.GetWalletPath(name)
-
-	// then
-	assert.Equal(t, configDir.WalletPath(name), path)
-}
-
-func newFileStoreV1(configDir configDir) *wallet.FileV1 {
-	s, err := wallet.NewFileStoreV1(configDir.RootPath())
-	if err != nil {
-		panic(err)
-	}
-	return s
-}
-
-func newWalletWithKeys() *wallet.Wallet {
-	w := wallet.NewWallet("my-wallet")
-
-	kp, err := wallet.GenKeypair(crypto.Ed25519)
-	if err != nil {
-		panic(err)
-	}
-
-	w.Keypairs.Upsert(*kp)
-
-	return w
-}
diff --git a/wallet/handler_deprecated_test.go b/wallet/handler_deprecated_test.go
index db15710..71afe7d 100644
--- a/wallet/handler_deprecated_test.go
+++ b/wallet/handler_deprecated_test.go
@@ -7,7 +7,6 @@ import (
 
 	"code.vegaprotocol.io/go-wallet/wallet"
 	"code.vegaprotocol.io/go-wallet/wallet/crypto"
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -24,19 +23,10 @@ func testSignTxSuccess(t *testing.T) {
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
 
-	// then start the test
-	h.auth.EXPECT().VerifyToken(gomock.Any()).AnyTimes().
-		Return(name, nil)
-
-	// first create the wallet
-	h.auth.EXPECT().NewSession(gomock.Any()).Times(1).
-		Return("some fake token", nil)
-
-	tok, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 	require.NoError(t, err)
-	assert.NotEmpty(t, tok)
 
-	key, err := h.GenerateKeypair(tok, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
@@ -44,7 +34,7 @@ func testSignTxSuccess(t *testing.T) {
 
 	keyBytes, _ := hex.DecodeString(key)
 
-	signedBundle, err := h.SignTx(tok, base64.StdEncoding.EncodeToString([]byte(message)), key, 42)
+	signedBundle, err := h.SignTx(name, base64.StdEncoding.EncodeToString([]byte(message)), key, 42)
 	require.NoError(t, err)
 
 	// verify signature then
@@ -63,27 +53,18 @@ func testSignTxFailure(t *testing.T) {
 	name := "jeremy"
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 
-	// then start the test
-	h.auth.EXPECT().VerifyToken(gomock.Any()).AnyTimes().
-		Return(name, nil)
-
-	// first create the wallet
-	h.auth.EXPECT().NewSession(gomock.Any()).Times(1).
-		Return("some fake token", nil)
-
-	tok, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 	require.NoError(t, err)
-	assert.NotEmpty(t, tok)
 
-	key, err := h.GenerateKeypair(tok, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
 	// taint the key
-	err = h.TaintKey(tok, key, passphrase)
+	err = h.TaintKey(name, key, passphrase)
 	require.NoError(t, err)
 
 	message := "hello world."
-	_, err = h.SignTx(tok, base64.StdEncoding.EncodeToString([]byte(message)), key, 42)
+	_, err = h.SignTx(name, base64.StdEncoding.EncodeToString([]byte(message)), key, 42)
 	assert.EqualError(t, err, wallet.ErrPubKeyIsTainted.Error())
 }
diff --git a/wallet/handler_test.go b/wallet/handler_test.go
index f45ca2d..5c09ccc 100644
--- a/wallet/handler_test.go
+++ b/wallet/handler_test.go
@@ -1,11 +1,10 @@
 package wallet_test
 
 import (
-	"errors"
+	"encoding/base64"
 	"testing"
 
 	"code.vegaprotocol.io/go-wallet/wallet"
-	"code.vegaprotocol.io/go-wallet/wallet/mocks"
 	"github.com/stretchr/testify/require"
 	commandspb "github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/commands/v1"
 	walletpb "github.com/vegaprotocol/api/grpc/clients/go/generated/code.vegaprotocol.io/vega/proto/wallet/v1"
@@ -17,20 +16,17 @@ import (
 type testHandler struct {
 	*wallet.Handler
 	ctrl  *gomock.Controller
-	auth  *mocks.MockAuth
 	store *mockedStore
 }
 
 func getTestHandler(t *testing.T) *testHandler {
 	ctrl := gomock.NewController(t)
-	auth := mocks.NewMockAuth(ctrl)
 	store := newMockedStore()
 
-	h := wallet.NewHandler(auth, store)
+	h := wallet.NewHandler(store)
 	return &testHandler{
 		Handler: h,
 		ctrl:    ctrl,
-		auth:    auth,
 		store:   store,
 	}
 }
@@ -41,30 +37,31 @@ func TestHandler(t *testing.T) {
 	t.Run("Recreating a wallet with same name and different passphrase fails", testHandlerRecreatingWalletWithSameNameButDifferentPassphraseFails)
 	t.Run("Login to existing wallet succeeds", testHandlerLoginToExistingWalletSucceeds)
 	t.Run("Login to non-existing wallet succeeds", testHandlerLoginToNonExistingWalletFails)
-	t.Run("Revoking right token success", testHandlerRevokingRightTokenSucceeds)
-	t.Run("Revoking invalid token fails", testHandlerRevokingInvalidTokenFails)
+	t.Run("Generating new key pair securely succeeds", testHandlerGeneratingNewKeyPairSecurelySucceeds)
+	t.Run("Generating new key pair securely with invalid name fails", testHandlerGeneratingNewKeyPairSecurelyWithInvalidNameFails)
+	t.Run("Generating new key pair securely without wallet fails", testHandlerGeneratingNewKeyPairSecurelyWithoutWalletFails)
 	t.Run("Generating new key pair succeeds", testHandlerGeneratingNewKeyPairSucceeds)
-	t.Run("Generating new key pair with invalid token fails", testHandlerGeneratingNewKeyPairWithInvalidTokenFails)
+	t.Run("Generating new key pair with invalid name fails", testHandlerGeneratingNewKeyPairWithInvalidNameFails)
 	t.Run("Generating new key pair without wallet fails", testHandlerGeneratingNewKeyPairWithoutWalletFails)
-	t.Run("Listing public keys with invalid token fails", testHandlerListingPublicKeysWithInvalidTokenFails)
+	t.Run("Listing public keys with invalid name fails", testHandlerListingPublicKeysWithInvalidNameFails)
 	t.Run("Listing public keys without wallet fails", testHandlerListingPublicKeysWithoutWalletFails)
 	t.Run("Getting public key succeeds", testHandlerGettingPublicKeySucceeds)
 	t.Run("Getting public key without wallet fails", testHandlerGettingPublicKeyWithoutWalletFails)
-	t.Run("Getting public key with invalid token fails", testHandlerGettingPublicKeyWithInvalidTokenFails)
+	t.Run("Getting public key with invalid name fails", testHandlerGettingPublicKeyWithInvalidNameFails)
 	t.Run("Getting non-existing public key fails", testGettingNonExistingPublicKeyFails)
 	t.Run("Tainting key pair succeeds", testHandlerTaintingKeyPairSucceeds)
-	t.Run("Tainting key pair with invalid token fails", testHandlerTaintingKeyPairWithInvalidTokenFails)
+	t.Run("Tainting key pair with invalid name fails", testHandlerTaintingKeyPairWithInvalidNameFails)
 	t.Run("Tainting key pair without wallet fails", testHandlerTaintingKeyPairWithoutWalletFails)
 	t.Run("Tainting key pair that is already tainted fails", testHandlerTaintingKeyThatIsAlreadyTaintedFails)
 	t.Run("Updating key pair meta succeeds", testHandlerUpdatingKeyPairMetaSucceeds)
 	t.Run("Updating key pair meta with invalid passphrase fails", testHandlerUpdatingKeyPairMetaWithInvalidPassphraseFails)
-	t.Run("Updating key pair meta with invalid token fails", testHandlerUpdatingKeyPairMetaWithInvalidTokenFails)
+	t.Run("Updating key pair meta with invalid name fails", testHandlerUpdatingKeyPairMetaWithInvalidNameFails)
 	t.Run("Updating key pair meta without wallet fails", testHandlerUpdatingKeyPairMetaWithoutWalletFails)
-	t.Run("Updating key pair meta with non-existing public key fails", testHandlerUpdatingKeyPairMetaWithNonExisitingPublicKeyFails)
+	t.Run("Updating key pair meta with non-existing public key fails", testHandlerUpdatingKeyPairMetaWithNonExistingPublicKeyFails)
 	t.Run("Get wallet path succeeds", testHandlerGettingWalletPathSucceeds)
-	t.Run("Get wallet path with invalid token fails", testHandlerGettingWalletPathWithInvalidTokenFails)
 	t.Run("Signing transaction request (v2) succeeds", testHandlerSigningTxV2Succeeds)
 	t.Run("Signing transaction request (v2) with tainted key fails", testHandlerSigningTxV2WithTaintedKeyFails)
+	t.Run("Signing and verifying a message succeeds", testHandlerSigningAndVerifyingMessageSucceeds)
 }
 
 func testHandlerCreatingWalletSucceeds(t *testing.T) {
@@ -74,18 +71,12 @@ func testHandlerCreatingWalletSucceeds(t *testing.T) {
 	// given
 	name := "jeremy"
 	passphrase := "Th1isisasecurep@ssphraseinnit"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(gomock.Any()).
-		Return("some fake token", nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
 }
 
 func testHandlerRecreatingWalletWithSameNameFails(t *testing.T) {
@@ -95,29 +86,18 @@ func testHandlerRecreatingWalletWithSameNameFails(t *testing.T) {
 	// given
 	name := "jeremy"
 	passphrase := "Th1isisasecurep@ssphraseinnit"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).
-		Return("some fake token", nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().NewSession(name).
-		Times(0)
 
 	// when
-	returnedToken, err = h.CreateWallet(name, passphrase)
+	err = h.CreateWallet(name, passphrase)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrWalletAlreadyExists.Error())
-	assert.Empty(t, returnedToken)
 }
 
 func testHandlerRecreatingWalletWithSameNameButDifferentPassphraseFails(t *testing.T) {
@@ -128,29 +108,18 @@ func testHandlerRecreatingWalletWithSameNameButDifferentPassphraseFails(t *testi
 	name := "jeremy"
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	othPassphrase := "different-passphrase"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).
-		Return("some fake token", nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().NewSession(name).
-		Times(0)
 
 	// when
-	returnedToken, err = h.CreateWallet(name, othPassphrase)
+	err = h.CreateWallet(name, othPassphrase)
 
 	// then
 	require.Error(t, err)
-	assert.Empty(t, returnedToken)
 }
 
 func testHandlerLoginToExistingWalletSucceeds(t *testing.T) {
@@ -160,28 +129,17 @@ func testHandlerLoginToExistingWalletSucceeds(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().NewSession(name).
-		Return(token, nil)
 
 	// then
-	returnedToken, err = h.LoginWallet(name, passphrase)
+	err = h.LoginWallet(name, passphrase)
 
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
 }
 
 func testHandlerLoginToNonExistingWalletFails(t *testing.T) {
@@ -192,78 +150,81 @@ func testHandlerLoginToNonExistingWalletFails(t *testing.T) {
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
 
-	// setup
-	h.auth.EXPECT().NewSession(gomock.Any()).
-		Times(0)
-
 	// when
-	returnedToken, err := h.LoginWallet(name, passphrase)
+	err := h.LoginWallet(name, passphrase)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
-	assert.Empty(t, returnedToken)
 }
 
-func testHandlerRevokingRightTokenSucceeds(t *testing.T) {
+func testHandlerGeneratingNewKeyPairSecurelySucceeds(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
 
-	// setup
-	h.auth.EXPECT().Revoke(token).Times(1).
-		Return(nil)
+	// when
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
+
+	// then
+	require.NoError(t, err)
+	assert.NotEmpty(t, key)
 
 	// when
-	err = h.RevokeToken(returnedToken)
+	keys, err := h.ListPublicKeys(name)
 
 	// then
 	require.NoError(t, err)
+	assert.Len(t, keys, 1)
+	assert.Equal(t, key, keys[0].Key)
+	assert.False(t, keys[0].Tainted)
 }
 
-func testHandlerRevokingInvalidTokenFails(t *testing.T) {
+func testHandlerGeneratingNewKeyPairSecurelyWithInvalidNameFails(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
+	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-	othToken := "bad token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
+	otherName := "bad name"
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
 
-	// setup
-	h.auth.EXPECT().Revoke(othToken).Times(1).
-		Return(errors.New(othToken))
+	// when
+	key, err := h.SecureGenerateKeyPair(otherName, passphrase)
+
+	// then
+	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
+	assert.Empty(t, key)
+}
+
+func testHandlerGeneratingNewKeyPairSecurelyWithoutWalletFails(t *testing.T) {
+	h := getTestHandler(t)
+	defer h.ctrl.Finish()
+
+	// given
+	name := "jeremy"
+	passphrase := "Th1isisasecurep@ssphraseinnit"
 
 	// when
-	err = h.RevokeToken(othToken)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
-	assert.EqualError(t, err, othToken)
+	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
+	assert.Empty(t, key)
 }
 
 func testHandlerGeneratingNewKeyPairSucceeds(t *testing.T) {
@@ -273,75 +234,54 @@ func testHandlerGeneratingNewKeyPairSucceeds(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	keyPair, err := h.GenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.NotEmpty(t, key)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
+	assert.NotEmpty(t, keyPair.Pub)
+	assert.NotEmpty(t, keyPair.Priv)
+	assert.False(t, keyPair.Tainted)
+	assert.Empty(t, keyPair.Meta)
 
 	// when
-	keys, err := h.ListPublicKeys(returnedToken)
+	keys, err := h.ListPublicKeys(name)
 
 	// then
 	require.NoError(t, err)
 	assert.Len(t, keys, 1)
-	assert.Equal(t, key, keys[0].Pub)
+	assert.Equal(t, keyPair.Pub, keys[0].Key)
 	assert.False(t, keys[0].Tainted)
 }
 
-func testHandlerGeneratingNewKeyPairWithInvalidTokenFails(t *testing.T) {
+func testHandlerGeneratingNewKeyPairWithInvalidNameFails(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-	othToken := "bad token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
+	otherName := "bad name"
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(othToken).
-		Return("", errors.New(othToken))
 
 	// when
-	key, err := h.GenerateKeypair(othToken, passphrase)
+	keyPair, err := h.GenerateKeyPair(otherName, passphrase)
 
 	// then
-	assert.EqualError(t, err, othToken)
-	assert.Empty(t, key)
+	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
+	assert.Empty(t, keyPair)
 }
 
 func testHandlerGeneratingNewKeyPairWithoutWalletFails(t *testing.T) {
@@ -351,50 +291,36 @@ func testHandlerGeneratingNewKeyPairWithoutWalletFails(t *testing.T) {
 	// given
 	name := "jeremy"
 	passphrase := "Th1isisasecurep@ssphraseinnit"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(token, passphrase)
+	keyPair, err := h.GenerateKeyPair(name, passphrase)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
-	assert.Empty(t, key)
+	assert.Empty(t, keyPair)
 }
 
-func testHandlerListingPublicKeysWithInvalidTokenFails(t *testing.T) {
+func testHandlerListingPublicKeysWithInvalidNameFails(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-	othToken := "bad token"
 
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
+	otherName := "bad name"
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(othToken).
-		Return("", errors.New(othToken))
 
 	// when
-	key, err := h.ListPublicKeys(othToken)
+	key, err := h.ListPublicKeys(otherName)
 
 	// then
-	assert.EqualError(t, err, othToken)
+	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
 	assert.Empty(t, key)
 }
 
@@ -404,14 +330,9 @@ func testHandlerListingPublicKeysWithoutWalletFails(t *testing.T) {
 
 	// given
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
 
 	// when
-	key, err := h.ListPublicKeys(token)
+	key, err := h.ListPublicKeys(name)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
@@ -424,14 +345,9 @@ func testHandlerGettingPublicKeyWithoutWalletFails(t *testing.T) {
 
 	// given
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
 
 	// when
-	key, err := h.GetPublicKey(token, name)
+	key, err := h.GetPublicKey(name, name)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
@@ -445,83 +361,55 @@ func testHandlerGettingPublicKeySucceeds(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
-
 	// when
-	keyPair, err := h.GetPublicKey(token, key)
+	keyPair, err := h.GetPublicKey(name, key)
 
 	require.NoError(t, err)
-	assert.Equal(t, key, keyPair.Pub)
-	assert.Empty(t, keyPair.Priv)
+	assert.Equal(t, key, keyPair.Key)
 }
 
-func testHandlerGettingPublicKeyWithInvalidTokenFails(t *testing.T) {
+func testHandlerGettingPublicKeyWithInvalidNameFails(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-	othToken := "bad token"
 
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
+	otherName := "bad name"
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(othToken).
-		Return("", errors.New(othToken))
-
 	// when
-	keyPair, err := h.GetPublicKey(othToken, key)
+	keyPair, err := h.GetPublicKey(otherName, key)
 
 	// then
-	assert.EqualError(t, err, othToken)
+	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
 	assert.Nil(t, keyPair)
 }
 
@@ -532,36 +420,22 @@ func testGettingNonExistingPublicKeyFails(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
-
 	// when
-	keyPair, err := h.GetPublicKey(token, "nonexistantpubkey")
+	keyPair, err := h.GetPublicKey(name, "non-existing-pub-key")
 	assert.EqualError(t, err, wallet.ErrPubKeyDoesNotExist.Error())
 	assert.Nil(t, keyPair)
 }
@@ -573,135 +447,90 @@ func testHandlerTaintingKeyPairSucceeds(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
-
 	// when
-	keyPair, err := h.GetPublicKey(token, key)
+	keyPair, err := h.GetPublicKey(name, key)
 
 	// then
 	require.NoError(t, err)
 	assert.NotNil(t, keyPair)
 	assert.False(t, keyPair.Tainted)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	err = h.TaintKey(token, key, passphrase)
+	err = h.TaintKey(name, key, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.True(t, h.store.GetKey(name, key).Tainted)
 }
 
-func testHandlerTaintingKeyPairWithInvalidTokenFails(t *testing.T) {
+func testHandlerTaintingKeyPairWithInvalidNameFails(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-	othToken := "other token"
 
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
+	otherName := "other name"
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
-
 	// when
-	keyPair, err := h.GetPublicKey(token, key)
+	keyPair, err := h.GetPublicKey(name, key)
 
 	// then
 	require.NoError(t, err)
 	assert.NotNil(t, keyPair)
 	assert.False(t, keyPair.Tainted)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(othToken).
-		Return("", errors.New(othToken))
-
 	// when
-	err = h.TaintKey(othToken, key, passphrase)
+	err = h.TaintKey(otherName, key, passphrase)
 
 	// then
 	assert.Error(t, err)
 }
 
-func testHandlerUpdatingKeyPairMetaWithNonExisitingPublicKeyFails(t *testing.T) {
+func testHandlerUpdatingKeyPairMetaWithNonExistingPublicKeyFails(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
 
 	// when
-	err = h.TaintKey(token, "non-existing-pub-key", passphrase)
+	err = h.TaintKey(name, "non-existing-pub-key", passphrase)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrPubKeyDoesNotExist.Error())
@@ -714,14 +543,9 @@ func testHandlerTaintingKeyPairWithoutWalletFails(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
 
 	// when
-	err := h.TaintKey(token, "non-existing-pub-key", passphrase)
+	err := h.TaintKey(name, "non-existing-pub-key", passphrase)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
@@ -734,59 +558,37 @@ func testHandlerTaintingKeyThatIsAlreadyTaintedFails(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
-
 	// when
-	keyPair, err := h.GetPublicKey(token, key)
+	keyPair, err := h.GetPublicKey(name, key)
 
 	// then
 	require.NoError(t, err)
 	assert.NotNil(t, keyPair)
 	assert.False(t, keyPair.Tainted)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	err = h.TaintKey(token, key, passphrase)
+	err = h.TaintKey(name, key, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.True(t, h.store.GetKey(name, key).Tainted)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	err = h.TaintKey(token, key, passphrase)
+	err = h.TaintKey(name, key, passphrase)
 
 	// then
 	assert.EqualError(t, err, wallet.ErrPubKeyAlreadyTainted.Error())
@@ -799,37 +601,24 @@ func testHandlerUpdatingKeyPairMetaSucceeds(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-	meta := []wallet.Meta{{Key: "primary", Value: "yes"}}
 
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
+	meta := []wallet.Meta{{Key: "primary", Value: "yes"}}
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	err = h.UpdateMeta(token, key, passphrase, meta)
+	err = h.UpdateMeta(name, key, passphrase, meta)
 
 	// then
 	require.NoError(t, err)
@@ -847,82 +636,55 @@ func testHandlerUpdatingKeyPairMetaWithInvalidPassphraseFails(t *testing.T) {
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	othPassphrase := "other-passphrase"
 	name := "jeremy"
-	token := "some fake token"
-	meta := []wallet.Meta{{Key: "primary", Value: "yes"}}
 
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
+	meta := []wallet.Meta{{Key: "primary", Value: "yes"}}
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	err = h.UpdateMeta(token, key, othPassphrase, meta)
+	err = h.UpdateMeta(name, key, othPassphrase, meta)
 
 	// then
 	assert.Error(t, err)
 	assert.Len(t, h.store.GetKey(name, key).Meta, 0)
 }
 
-func testHandlerUpdatingKeyPairMetaWithInvalidTokenFails(t *testing.T) {
+func testHandlerUpdatingKeyPairMetaWithInvalidNameFails(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
 
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-	othToken := "other token"
+	otherName := "other name"
 	meta := []wallet.Meta{{Key: "primary", Value: "yes"}}
 
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
-
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	key, err := h.GenerateKeypair(returnedToken, passphrase)
+	key, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, key)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return("", errors.New(othToken))
-
 	// when
-	err = h.UpdateMeta(token, key, passphrase, meta)
+	err = h.UpdateMeta(otherName, key, passphrase, meta)
 
 	// then
 	assert.Error(t, err)
@@ -936,16 +698,12 @@ func testHandlerUpdatingKeyPairMetaWithoutWalletFails(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
+
 	pubKey := "non-existing-public-key"
 	meta := []wallet.Meta{{Key: "primary", Value: "yes"}}
 
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
-
 	// when
-	err := h.UpdateMeta(token, pubKey, passphrase, meta)
+	err := h.UpdateMeta(name, pubKey, passphrase, meta)
 
 	// then
 	assert.Error(t, err)
@@ -957,39 +715,15 @@ func testHandlerGettingWalletPathSucceeds(t *testing.T) {
 
 	// given
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return(name, nil)
 
 	// when
-	path, err := h.GetWalletPath(token)
+	path, err := h.GetWalletPath(name)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, path)
 }
 
-func testHandlerGettingWalletPathWithInvalidTokenFails(t *testing.T) {
-	h := getTestHandler(t)
-	defer h.ctrl.Finish()
-
-	// given
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().VerifyToken(token).
-		Return("", errors.New(token))
-
-	// when
-	path, err := h.GetWalletPath(token)
-
-	// then
-	assert.Error(t, err)
-	assert.Empty(t, path)
-}
-
 func testHandlerSigningTxV2Succeeds(t *testing.T) {
 	h := getTestHandler(t)
 	defer h.ctrl.Finish()
@@ -997,44 +731,30 @@ func testHandlerSigningTxV2Succeeds(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	pubKey, err := h.GenerateKeypair(returnedToken, passphrase)
+	pubKey, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, pubKey)
 
 	// given
-	req := walletpb.SubmitTransactionRequest{
+	req := &walletpb.SubmitTransactionRequest{
 		PubKey: pubKey,
 		Command: &walletpb.SubmitTransactionRequest_OrderCancellation{
 			OrderCancellation: &commandspb.OrderCancellation{},
 		},
 	}
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	tx, err := h.SignTxV2(returnedToken, req, 42)
+	tx, err := h.SignTxV2(name, req, 42)
 
 	// then
 	require.NoError(t, err)
@@ -1055,57 +775,82 @@ func testHandlerSigningTxV2WithTaintedKeyFails(t *testing.T) {
 	// given
 	passphrase := "Th1isisasecurep@ssphraseinnit"
 	name := "jeremy"
-	token := "some fake token"
-
-	// setup
-	h.auth.EXPECT().NewSession(name).Times(1).
-		Return(token, nil)
 
 	// when
-	returnedToken, err := h.CreateWallet(name, passphrase)
+	err := h.CreateWallet(name, passphrase)
 
 	// then
 	require.NoError(t, err)
-	assert.Equal(t, token, returnedToken)
-
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
 
 	// when
-	pubKey, err := h.GenerateKeypair(returnedToken, passphrase)
+	pubKey, err := h.SecureGenerateKeyPair(name, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.NotEmpty(t, pubKey)
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	err = h.TaintKey(token, pubKey, passphrase)
+	err = h.TaintKey(name, pubKey, passphrase)
 
 	// then
 	require.NoError(t, err)
 	assert.True(t, h.store.GetKey(name, pubKey).Tainted)
 
 	// given
-	req := walletpb.SubmitTransactionRequest{
+	req := &walletpb.SubmitTransactionRequest{
 		PubKey: pubKey,
 		Command: &walletpb.SubmitTransactionRequest_OrderCancellation{
 			OrderCancellation: &commandspb.OrderCancellation{},
 		},
 	}
 
-	// setup
-	h.auth.EXPECT().VerifyToken(returnedToken).
-		Return(name, nil)
-
 	// when
-	tx, err := h.SignTxV2(returnedToken, req, 42)
+	tx, err := h.SignTxV2(name, req, 42)
 
 	// then
 	assert.Error(t, err)
 	assert.Nil(t, tx)
 }
+
+func testHandlerSigningAndVerifyingMessageSucceeds(t *testing.T) {
+	h := getTestHandler(t)
+	defer h.ctrl.Finish()
+
+	// given
+	passphrase := "Th1isisasecurep@ssphraseinnit"
+	name := "jeremy"
+
+	// when
+	err := h.CreateWallet(name, passphrase)
+
+	// then
+	require.NoError(t, err)
+
+	// when
+	pubKey, err := h.SecureGenerateKeyPair(name, passphrase)
+
+	// then
+	require.NoError(t, err)
+	assert.NotEmpty(t, pubKey)
+
+	// given
+	data := "Je ne connaîtrai pas la peur car la peur tue l'esprit. La peur est la petite mort qui conduit à l'oblitération totale."
+	encodedData := base64.StdEncoding.EncodeToString([]byte(data))
+
+	// when
+	sig, err := h.SignAny(name, encodedData, pubKey)
+
+	// then
+	require.NoError(t, err)
+	assert.NotEmpty(t, sig)
+
+	// given
+	encodedSig := base64.StdEncoding.EncodeToString(sig)
+
+	// when
+	verified, err := h.VerifyAny(name, encodedData, encodedSig, pubKey)
+
+	// then
+	require.NoError(t, err)
+	assert.True(t, verified)
+}
diff --git a/wallet/keys_for_test.go b/wallet/keys_for_test.go
index d92e277..ecdd8be 100644
--- a/wallet/keys_for_test.go
+++ b/wallet/keys_for_test.go
@@ -2,8 +2,8 @@ package wallet
 
 import "code.vegaprotocol.io/go-wallet/wallet/crypto"
 
-func NewKeypair(algo crypto.SignatureAlgorithm, pub, priv []byte) Keypair {
-	return Keypair{
+func NewKeypair(algo crypto.SignatureAlgorithm, pub, priv []byte) KeyPair {
+	return KeyPair{
 		Algorithm: algo,
 		pubBytes:  pub,
 		privBytes: priv,
diff --git a/wallet/keys_test.go b/wallet/keys_test.go
index 36eefec..670ae7e 100644
--- a/wallet/keys_test.go
+++ b/wallet/keys_test.go
@@ -61,12 +61,12 @@ func testKeyRingGettingPublicKeysSucceeds(t *testing.T) {
 	ring.Upsert(*kp2)
 
 	// when
-	keys := ring.GetPubKeys()
+	keys := ring.GetPublicKeys()
 
 	// then
 	assert.Len(t, keys, 2)
-	assert.Contains(t, keys, kp1.SecureCopy())
-	assert.Contains(t, keys, kp2.SecureCopy())
+	assert.Contains(t, keys, *kp1.ToPublicKey())
+	assert.Contains(t, keys, *kp2.ToPublicKey())
 }
 
 func testKeyRingFindingExistingKeyPairSucceeds(t *testing.T) {
@@ -102,7 +102,7 @@ func testKeyRingFindingNonExistingKeyPairFails(t *testing.T) {
 
 	// then
 	assert.Error(t, err)
-	assert.Equal(t, wallet.Keypair{}, returnedKp)
+	assert.Equal(t, wallet.KeyPair{}, returnedKp)
 }
 
 func TestKeypair(t *testing.T) {
@@ -110,7 +110,7 @@ func TestKeypair(t *testing.T) {
 	t.Run("Generating a new key pair with unsupported algorithm fails", testKeypairGeneratingNewKeyPairWithUnsupportedAlgorithmFails)
 	t.Run("Tainting a key pair succeeds", testKeypairTaintingKeyPairSucceeds)
 	t.Run("Tainting an already tainted key pair fails", testKeypairTaintingAlreadyTaintedKeyPairFails)
-	t.Run("Secure copy of key pair removes sensitive information", testKeypairSecureCopyRemovesSensitiveInformation)
+	t.Run("Secure copy of key pair removes sensitive information", testKeypairToPublicKeyRemovesSensitiveInformation)
 }
 
 func testKeypairGeneratingNewKeyPairSucceeds(t *testing.T) {
@@ -167,23 +167,22 @@ func testKeypairTaintingAlreadyTaintedKeyPairFails(t *testing.T) {
 	assert.True(t, kp.Tainted)
 }
 
-func testKeypairSecureCopyRemovesSensitiveInformation(t *testing.T) {
+func testKeypairToPublicKeyRemovesSensitiveInformation(t *testing.T) {
 	// given
 	kp := newKeyPair()
 
 	// when
-	secureKp := kp.SecureCopy()
+	secureKp := kp.ToPublicKey()
 
 	// then
-	assert.Equal(t, kp.Pub, secureKp.Pub)
-	assert.Empty(t, secureKp.Priv)
+	assert.Equal(t, kp.Pub, secureKp.Key)
 	assert.Equal(t, kp.Tainted, secureKp.Tainted)
 	assert.Equal(t, kp.Algorithm.Name(), secureKp.Algorithm.Name())
 	assert.Equal(t, kp.Algorithm.Version(), secureKp.Algorithm.Version())
 	assert.Equal(t, kp.Meta, secureKp.Meta)
 }
 
-func newKeyPair() *wallet.Keypair {
+func newKeyPair() *wallet.KeyPair {
 	kp, err := wallet.GenKeypair(crypto.Ed25519)
 	if err != nil {
 		panic(err)
diff --git a/wallet/handler_helper_test.go b/wallet/mocked_store_for_test.go
similarity index 83%
rename from wallet/handler_helper_test.go
rename to wallet/mocked_store_for_test.go
index bdf1929..6ba7bb3 100644
--- a/wallet/handler_helper_test.go
+++ b/wallet/mocked_store_for_test.go
@@ -19,6 +19,11 @@ func newMockedStore() *mockedStore {
 	}
 }
 
+func (m *mockedStore) WalletExists(name string) bool {
+	_, ok := m.wallets[name]
+	return ok
+}
+
 func (m *mockedStore) SaveWallet(w wallet.Wallet, passphrase string) error {
 	m.passphrase = passphrase
 	m.wallets[w.Owner] = w
@@ -40,12 +45,12 @@ func (m *mockedStore) GetWalletPath(name string) string {
 	return fmt.Sprintf("some/path/%v", name)
 }
 
-func (m *mockedStore) GetKey(name, pubKey string) wallet.Keypair {
+func (m *mockedStore) GetKey(name, pubKey string) wallet.KeyPair {
 	w, ok := m.wallets[name]
 	if !ok {
 		panic(fmt.Errorf("wallet \"%v\" not found", name))
 	}
-	pair, err := w.Keypairs.FindPair(pubKey)
+	pair, err := w.KeyRing.FindPair(pubKey)
 	if err != nil {
 		panic(fmt.Errorf("key \"%v\" not found", pubKey))
 	}
diff --git a/wallet/wallet_marshal_test.go b/wallet/wallet_marshal_test.go
index 7d930ff..5a14557 100644
--- a/wallet/wallet_marshal_test.go
+++ b/wallet/wallet_marshal_test.go
@@ -11,7 +11,7 @@ import (
 
 func TestMarshalWallet(t *testing.T) {
 	w := New("jeremy")
-	w.Keypairs = append(w.Keypairs, NewKeypair(crypto.NewEd25519(), []byte{1, 2, 3, 4}, []byte{4, 3, 2, 1}))
+	w.KeyRing = append(w.KeyRing, NewKeypair(crypto.NewEd25519(), []byte{1, 2, 3, 4}, []byte{4, 3, 2, 1}))
 	expected := `{"Owner":"jeremy","Keypairs":[{"pub":"01020304","priv":"04030201","algo":"vega/ed25519","tainted":false,"meta":null}]}`
 	m, err := json.Marshal(&w)
 	assert.NoError(t, err)
@@ -23,10 +23,10 @@ func TestUnMarshalWallet(t *testing.T) {
 	marshalled := `{"Owner":"jeremy","Keypairs":[{"pub":"01020304","priv":"04030201","algo":"vega/ed25519","tainted":false,"meta":null}]}`
 	err := json.Unmarshal([]byte(marshalled), &w)
 	assert.NoError(t, err)
-	assert.Len(t, w.Keypairs, 1)
-	assert.Equal(t, []byte{1, 2, 3, 4}, w.Keypairs[0].pubBytes)
-	assert.Equal(t, []byte{4, 3, 2, 1}, w.Keypairs[0].privBytes)
-	assert.Equal(t, "vega/ed25519", w.Keypairs[0].Algorithm.Name())
+	assert.Len(t, w.KeyRing, 1)
+	assert.Equal(t, []byte{1, 2, 3, 4}, w.KeyRing[0].pubBytes)
+	assert.Equal(t, []byte{4, 3, 2, 1}, w.KeyRing[0].privBytes)
+	assert.Equal(t, "vega/ed25519", w.KeyRing[0].Algorithm.Name())
 }
 
 func TestUnMarshalWalletErrorInvalidAlgorithm(t *testing.T) {
diff --git a/wallet/wallet_test.go b/wallet/wallet_test.go
deleted file mode 100644
index 1379be8..0000000
--- a/wallet/wallet_test.go
+++ /dev/null
@@ -1,136 +0,0 @@
-package wallet_test
-
-import (
-	"os"
-	"testing"
-
-	"code.vegaprotocol.io/go-wallet/fsutil"
-	"code.vegaprotocol.io/go-wallet/wallet"
-	wcrypto "code.vegaprotocol.io/go-wallet/wallet/crypto"
-
-	"github.com/stretchr/testify/assert"
-)
-
-var (
-	rootDirPath = "/tmp/vegatests/wallet/"
-)
-
-func TestWallet(t *testing.T) {
-	t.Run("create a wallet success", testCreateWallet)
-	t.Run("create a wallet failure", testCreateWalletFailure)
-	t.Run("read a wallet success", testReadWallet)
-	t.Run("read a wallet failure invalid passphrase", testReadWalletFailureInvalidPassphrase)
-	t.Run("read a wallet failure does not exist", testReadWalletFailureDoesNotExist)
-	t.Run("add a keypair to a wallet", testAddKeyPairToWallet)
-}
-
-func testCreateWallet(t *testing.T) {
-	rootDir := rootDir()
-	fsutil.EnsureDir(rootDir)
-	wallet.EnsureBaseFolder(rootDir)
-
-	w, err := wallet.Create(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err)
-	assert.NotNil(t, w)
-
-	assert.NoError(t, os.RemoveAll(rootDir))
-}
-
-func testCreateWalletFailure(t *testing.T) {
-	rootDir := rootDir()
-	fsutil.EnsureDir(rootDir)
-	wallet.EnsureBaseFolder(rootDir)
-
-	// fist time is fine
-	w, err := wallet.Create(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err)
-	assert.NotNil(t, w)
-
-	w, err = wallet.Create(rootDir, "jeremy", "whateverthepassphrase")
-	assert.EqualError(t, err, wallet.ErrWalletAlreadyExists.Error())
-	assert.Nil(t, w)
-
-	assert.NoError(t, os.RemoveAll(rootDir))
-}
-
-func testReadWallet(t *testing.T) {
-	rootDir := rootDir()
-	fsutil.EnsureDir(rootDir)
-	wallet.EnsureBaseFolder(rootDir)
-
-	w, err := wallet.Create(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err)
-	assert.NotNil(t, w)
-
-	// no try to read the same wallet
-	w1, err1 := wallet.Read(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err1)
-	assert.NotNil(t, w1)
-
-	assert.NoError(t, os.RemoveAll(rootDir))
-}
-
-func testReadWalletFailureDoesNotExist(t *testing.T) {
-	rootDir := rootDir()
-	fsutil.EnsureDir(rootDir)
-	wallet.EnsureBaseFolder(rootDir)
-
-	// try to read a wallet which do not exists
-	w, err := wallet.Read(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.EqualError(t, err, wallet.ErrWalletDoesNotExists.Error())
-	assert.Nil(t, w)
-
-	assert.NoError(t, os.RemoveAll(rootDir))
-}
-
-func testReadWalletFailureInvalidPassphrase(t *testing.T) {
-	rootDir := rootDir()
-	fsutil.EnsureDir(rootDir)
-	wallet.EnsureBaseFolder(rootDir)
-
-	w, err := wallet.Create(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err)
-	assert.NotNil(t, w)
-
-	// no try to read the same wallet
-	w1, err1 := wallet.Read(rootDir, "jeremy", "thisisasecurepassph")
-	assert.EqualError(t, err1, "cipher: message authentication failed")
-	assert.Nil(t, w1)
-
-	assert.NoError(t, os.RemoveAll(rootDir))
-}
-
-func testAddKeyPairToWallet(t *testing.T) {
-	rootDir := rootDir()
-	fsutil.EnsureDir(rootDir)
-	wallet.EnsureBaseFolder(rootDir)
-
-	w, err := wallet.Create(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err)
-	assert.NotNil(t, w)
-
-	// now try to read the same wallet
-	w1, err1 := wallet.Read(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err1)
-	assert.NotNil(t, w1)
-	assert.Len(t, w1.Keypairs, 0)
-
-	// create the keypair
-	kp := wallet.NewKeypair(wcrypto.NewEd25519(), []byte{1, 2, 3, 255}, []byte{253, 3, 2, 1})
-
-	// now try to add the keypair to the wallet
-	w2, err2 := wallet.AddKeypair(&kp, rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err2)
-	assert.NotNil(t, w2)
-
-	// now try to read the same wallet a last time, and make sur the values are right
-	w3, err3 := wallet.Read(rootDir, "jeremy", "thisisasecurepassphraseinnit")
-	assert.NoError(t, err3)
-	assert.NotNil(t, w3)
-	assert.Len(t, w3.Keypairs, 1)
-	// check the hex value of the keypair
-	assert.Equal(t, "010203ff", w3.Keypairs[0].Pub)
-	assert.Equal(t, "fd030201", w3.Keypairs[0].Priv)
-
-	assert.NoError(t, os.RemoveAll(rootDir))
-}