# Set up the custody gateway

Source: https://docs.settlemint.com/docs/console/asset-lifecycle/custody-gateway-setup
Enable the coins clients can deposit, create profiles, review where payouts come from, and set up and rotate the keeper and screener wallets.

Set up the custody gateway add-on once for your organisation's system on a network. The add-on needs four things before a client can use a gateway: an enabled coin, a profile, a keeper and a screener, and the gateway itself. The **Setup** tab lists them as a checklist and ticks each one as you finish it. [How a custody gateway works](https://docs.settlemint.com/docs/concepts/custody-and-signing/custody-gateway) explains what each piece does.

## Before you start [#before-you-start]

- Your organisation admin has enabled the custody gateway add-on for the system. Until then the page says "Custody gateway is not enabled".
- You hold a role that can sign gateway changes. A wallet without it sees "You can't manage the custody gateway", and a button that needs a role the wallet lacks says which one.
- You have a custody provider configured under [Custody providers](https://docs.settlemint.com/docs/console/organisation-settings/custody). The keeper and the screener each sign from a wallet held by one.
- For every coin you enable, you have the coin's custody receipt token. The receipt is a separate token that stands for the coin, and it must carry the own-custody-gateway compliance rule bound to this add-on.

## Open the add-on [#open-the-add-on]

Open "Asset lifecycle", then "Custody gateway". The page has the tabs "Setup", "Coins", "Profiles", "Permissions", "Treasury" and "Approvals". "Approvals" lists changes that wait for a second approver and is the subject of [Approve custody gateway changes](https://docs.settlemint.com/docs/console/asset-lifecycle/custody-gateway-approvals).

![The Custody gateway Setup tab with a checklist of four steps: a coin enabled, a profile created, keeper and screener set up, and a gateway created](https://docs.settlemint.com/docs/screenshots/console-custody-gateway-setup.light.en.webp)

[Screenshot] The Setup tab of the custody gateway, with a checklist of four steps and the state of each.

The checklist lists "A coin enabled", "A profile created", "Keeper and screener set up" and "A gateway created", above the "Coins", "Profiles", "Permissions", "Treasury" and "Approvals" tabs.

## Enable a coin [#enable-a-coin]

1. Open the "Coins" tab and select "Enable coin".
2. Choose the "Coin" clients deposit and its "Custody receipt". The two must be different tokens.
3. Enter the "Freeze expiry (days)" and the "Paused exit after (days)". Both are required. The freeze expiry is how long a freeze lasts before it ends on its own. The paused exit is how long a gateway can stay paused before a client may leave it.
4. Select "Enable coin" and confirm with your wallet verification.

The add-on refuses a receipt whose decimals differ from the coin's, a receipt without the gateway compliance rule, and a freeze expiry or paused exit of zero. A coin that is already enabled cannot be enabled a second time. Other settings, such as fees, the cancel time limit and auto-collect, can be changed per coin through the [API](https://docs.settlemint.com/docs/api-reference/guides/custody-gateway-api).

## Create a profile [#create-a-profile]

A profile is a named set of settings that gateways share. Create at least one before you create a gateway.

1. Open the "Profiles" tab and select "Create a profile".
2. Enter a "Name" and the "Required claim topic", the numeric topic id of the verification claim a client must hold. A client whose claim is revoked or expires is flagged, as [Review deposits and withdrawals](https://docs.settlemint.com/docs/console/asset-lifecycle/custody-gateway-review#when-a-client-is-flagged) describes.
3. Select "Create profile".

Select "Remove" on a profile row to delete it. A profile that gateways still use cannot be removed.

## Check where payouts come from [#check-where-payouts-come-from]

The "Treasury" tab lists each enabled coin with its "Treasury" address and its "Payout mode": "Approval wallet" or "Vault". "No treasury: pooled requests wait for funding" means no treasury is set, so a withdrawal that needs the pooled funds waits until funding arrives. The tab is read-only. Changing a treasury needs the add-on's checker approval and is not available in the Console yet, so use the [API](https://docs.settlemint.com/docs/api-reference/guides/custody-gateway-api).

## Grant the manager role [#grant-the-manager-role]

The "Permissions" tab shows "Gateway managers" and "Signers". Gateway managers are roles, and you grant them on the add-on roles page rather than here.

1. On "Permissions", select "Open add-on roles". The page also sits under "Organisation settings", "Roles and permissions", "Add-on roles".
2. Select "Grant a role", choose "Manager" for the person and select "Grant role".

On a new system nobody holds a gateway role yet, so the page lists no holders and still offers "Grant a role". The first grant also creates the add-on's access manager in the same write. One grant covers every gateway of the add-on. Only a holder of the custody gateway permission manager role can grant or revoke these roles. Everyone else sees the page read-only.

## Set up the keeper and the screener [#set-up-the-keeper-and-the-screener]

The keeper moves deposits and runs the payout queue. The screener checks deposits and withdrawals. Both are service wallets held by a custody provider, not people.

1. On "Permissions", find the "Keeper" or the "Screener" card under "Signers".
2. Select "Set up", choose the "Custody provider" and confirm with your wallet verification.
3. Wait for the signer to become active. The card shows its state: "Pending", "Granted" or "Active". A request that needs a checker waits on the "Approvals" tab.
4. Set a "Low-balance threshold" so the card shows "Low balance" before the wallet runs out of gas. The card shows the wallet's "Balance".

With no provider configured the card says "Add a custody provider configuration before you set up a signer."

### Rotate a signer [#rotate-a-signer]

Rotate a signer when its wallet is lost, exposed or retired.

1. On the signer's card, select "Rotate".
2. Choose the "Custody provider" of the new wallet and confirm.
3. The card shows "Next signer" with the new wallet's state until it is active. The old wallet then shows as "Retired", and a wallet whose role was withdrawn shows as "Revoked".

Records the old wallet was handling keep their stage. The new signer picks them up once it is active.

## You should see [#you-should-see]

- Return to the "Setup" tab. "A coin enabled", "A profile created" and "Keeper and screener set up" show as done. Next, [create a gateway for a client](https://docs.settlemint.com/docs/console/asset-lifecycle/custody-gateway-create), which completes "A gateway created".

## Related pages [#related-pages]

- [How a custody gateway works](https://docs.settlemint.com/docs/concepts/custody-and-signing/custody-gateway)
- [Create a client gateway](https://docs.settlemint.com/docs/console/asset-lifecycle/custody-gateway-create)
- [Review deposits and withdrawals](https://docs.settlemint.com/docs/console/asset-lifecycle/custody-gateway-review)
- [Approve custody gateway changes](https://docs.settlemint.com/docs/console/asset-lifecycle/custody-gateway-approvals)
- [Run the add-on through the API](https://docs.settlemint.com/docs/api-reference/guides/custody-gateway-api)