# Non-custodial integration When the user holds their own key, you orchestrate everything around the money movement but never touch the key. The user signs on their device, and the node itself enforces that no one but the key holder can move that account's funds. That is the guarantee, and it is enforced by the protocol, not by your good intentions.  ```ts import { toViemAccount } from "@privy-io/react-auth"; // the account comes from the user's embedded wallet; the key stays on their device const account = await toViemAccount(embeddedWallet); // 1. prepare the unsigned zone transaction (nonce, gas, chainId set here) // no signer is present at build time, so `from` is passed explicitly as an address const { unsignedTx } = await kakushi.transfers.prepare({ from: account.address, to: "0xRecipientZoneAddress", amount: "40.00", token: "USDC", }); // 2. the user signs locally, in their wallet, nothing is broadcast const signedTx = await account.signTransaction(unsignedTx); // 3. submit over the authenticated RPC; the user's auth token in the header // matches the transaction's signer, which is what the node requires await kakushi.transfers.submit(signedTx); ``` The node's rule is absolute: a transaction only lands when its recovered `from` equals the address of the auth token in the request header. So even you, the operator, cannot move a user's funds without the user's signature. :::warning This V1 path targets embedded and programmatic wallets, like Privy, where the client can sign locally with a real key. Injected wallets like MetaMask do not expose the raw signing the auth token needs, so they become first-class in V2 through smart accounts and a paymaster. See the Privy examples for React (key on the user's device) and Node (server-held key). :::