MetaMask · stanleyyconsensys · Sep 2, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Add `exportAccount` keyring method for base32 Stellar secret-seed export ([#187](https://github.com/MetaMask/internal-snaps/pull/187))
 - Add `TrustlineExceedLimitException` for send simulation when a payment would exceed the destination trustline limit (previously a generic `TransactionValidationException`) ([#185](https://github.com/MetaMask/internal-snaps/pull/185))
 - Add `@metamask/snap-networks-utils` `^1.0.0` ([#182](https://github.com/MetaMask/internal-snaps/pull/182))
   - Use the shared `Logger`

@@ -15,6 +15,7 @@ Account management and SEP-43 signing entry points via `onKeyringRequest` → `K
 | `AccountService`        | `services/account`          | Persist / derive / select accounts (snap state)                         |
 | `OnChainAccountService` | `services/on-chain-account` | Snap-state snapshots for balances/assets; live activation for discovery |
 | `TransactionService`    | `services/transaction`      | Local pending keyring txs for `listAccountTransactions`                 |
+| `WalletService`         | `services/wallet`           | HD derive signing material; used by `exportAccount` (never persisted)   |
 | `SyncAccountsHandler`   | `handlers/cronjob`          | Scheduled after selection changes to refresh on-chain snapshots         |
 
 ## Request / response
@@ -45,6 +46,7 @@ Requests are origin-checked, then dispatched to the methods below.
 | `listAccountTransactions` | Paginated keyring transactions for the account                                                                           | **Snap state** (pending / local txs via `TransactionService` — **not** Horizon history)        |
 | `discoverAccounts`        | Derive BIP-44 address for index; return it only if activated on any requested scope                                      | Derive locally; activation check is **live on-chain** (`NetworkService.getAccount`)            |
 | `resolveAccountAddress`   | Given an address, return CAIP-10 if this snap owns it; else `null` (MetaMask may fall back)                              | **Snap state** (keyring account lookup by address)                                             |
+| `exportAccount`           | Export the Stellar secret seed (`S…` strkey / base32). Only `encoding: "base32"` is supported                            | **Derived** via `WalletService` (never persisted)                                              |
 | `filterAccountChains`     | Not implemented                                                                                                          | Throws `MethodNotSupportedError`                                                               |
 | `updateAccount`           | Not implemented                                                                                                          | Throws `MethodNotSupportedError`                                                               |
 | `submitRequest`           | [signTransaction.md](./signTransaction.md) · [signMessage.md](./signMessage.md) · [signAuthEntry.md](./signAuthEntry.md) |                                                                                                |
@@ -3,6 +3,7 @@ import { assert, StructError } from '@metamask/superstruct';
 import {
   StellarAddressOrContractStruct,
   StellarAddressStruct,
+  StellarSecretKeyStruct,
 } from './address';
 
 describe('StellarAddressStruct', () => {
@@ -21,6 +22,25 @@ describe('StellarAddressStruct', () => {
   });
 });
 
+describe('StellarSecretKeyStruct', () => {
+  it('accepts a valid Stellar secret seed', () => {
+    expect(() =>
+      assert(
+        'SAKICEVQLYWGSOJS4WW7HZJWAHZVEEBS527LHK5V4MLJALYKICQCJXMW',
+        StellarSecretKeyStruct,
+      ),
+    ).not.toThrow();
+  });
+
+  it.each([
+    'invalid-secret',
+    'GA7UCNSASSOPQYTRGJ2NC7TDBSXHMWK6JHS7AO6X2ZQAIQSTB5ELNFSO',
+    '',
+  ])('rejects an invalid Stellar secret seed: "%s"', (secret) => {
+    expect(() => assert(secret, StellarSecretKeyStruct)).toThrow(StructError);
+  });
+});
+
 describe('StellarAddressOrContractStruct', () => {
   it('accepts a valid Stellar address', () => {
     expect(() =>

@@ -1,4 +1,4 @@
-import { refine, string, nonempty } from '@metamask/superstruct';
+import { refine, string, nonempty, sensitive } from '@metamask/superstruct';
 import type { Infer } from '@metamask/superstruct';
 import { StrKey } from '@stellar/stellar-sdk';
 
@@ -7,7 +7,7 @@ import { StrKey } from '@stellar/stellar-sdk';
  * We only support non-muxed addresses.
  */
 export const StellarAddressStruct = refine(
-  nonempty(string()),
+  nonempty(sensitive(string())),
   'stellar_address',
   (value: string) => {
     try {
@@ -21,6 +21,29 @@ export const StellarAddressStruct = refine(
   },
 );
 
+/**
+ * Validation struct for a Stellar secret seed (`S…` strkey / base32).
+ */
+export const StellarSecretKeyStruct = refine(
+  nonempty(string()),
+  'stellar_secret_key',
+  (value: string) => {
+    try {
+      if (!StrKey.isValidEd25519SecretSeed(value)) {
+        return 'Invalid Stellar secret key';
+      }
+      return true;
+    } catch {
+      return 'Invalid Stellar secret key';
+    }
+  },
+);
+
+/**
+ * Type for a Stellar secret seed.
+ */
+export type StellarSecretKey = Infer<typeof StellarSecretKeyStruct>;
+
 export const StellarAddressOrContractStruct = refine(
   nonempty(string()),
   'stellar_contract_or_address',

@@ -9,6 +9,14 @@ import snapManifest from '../snap.manifest.json';
 export const SUPPORTED_SCOPES =
   snapManifest.initialPermissions['endowment:keyring'].capabilities.scopes;
 
+/**
+ * Private-key export encoding supported by this snap.
+ *
+ * Always `base32` (Stellar `S…` strkey). Not read from the snap manifest:
+ * this snap does not support any other encoding.
+ */
+export const PRIVATE_KEY_EXPORT_ENCODING = 'base32' as const;
+
 /**
  * The base reserve for the Stellar network.
  *

@@ -174,6 +174,7 @@ const keyringHandler = new KeyringHandler({
   accountService,
   onChainAccountService,
   transactionService,
+  walletService,
   handlers: keyringMethodHandlers,
 });
 

@@ -1,10 +1,11 @@
-import { assert, StructError } from '@metamask/superstruct';
+import { assert, create, StructError } from '@metamask/superstruct';
 
 import { KnownCaip2ChainId } from '../../api';
 import type { StellarKeyringAccount } from '../../services/account';
 import { generateMockStellarKeyringAccounts } from '../../services/account/__mocks__/account.fixtures';
 import {
   CreateAccountOptionsStruct,
+  ExportAccountRequestStruct,
   ResolveAccountAddressRequestStruct,
   ListAccountTransactionsRequestStruct,
   MultichainMethod,
@@ -586,3 +587,61 @@ describe('ListAccountTransactionsRequestStruct', () => {
     );
   });
 });
+
+describe('ExportAccountRequestStruct', () => {
+  it.each([
+    {
+      request: { accountId: account.id },
+      expected: {
+        accountId: account.id,
+        options: { type: 'private-key' as const, encoding: 'base32' as const },
+      },
+    },
+    {
+      request: {
+        accountId: account.id,
+        options: { type: 'private-key' as const },
+      },
+      expected: {
+        accountId: account.id,
+        options: { type: 'private-key' as const, encoding: 'base32' as const },
+      },
+    },
+    {
+      request: {
+        accountId: account.id,
+        options: { type: 'private-key' as const, encoding: 'base32' as const },
+      },
+      expected: {
+        accountId: account.id,
+        options: { type: 'private-key' as const, encoding: 'base32' as const },
+      },
+    },
+  ])('accepts a valid exportAccount request', ({ request, expected }) => {
+    expect(create(request, ExportAccountRequestStruct)).toStrictEqual(expected);
+  });
+
+  it.each([
+    { accountId: 'not-a-uuid' },
+    {
+      accountId: account.id,
+      options: { type: 'mnemonic', encoding: 'base32' },
+    },
+    {
+      accountId: account.id,
+      options: { type: 'private-key', encoding: 'utf-8' },
+    },
+    {
+      accountId: account.id,
+      options: { type: 'private-key', encoding: 'hexadecimal' },
+    },
+    {
+      accountId: account.id,
+      options: { type: 'private-key', encoding: 'base58' },
+    },
+  ])('rejects an invalid exportAccount request', (request) => {
+    expect(() => assert(request, ExportAccountRequestStruct)).toThrow(
+      StructError,
+    );
+  });
+});
@@ -15,6 +15,7 @@ import {
   nullable,
   enums,
   refine,
+  defaulted,
 } from '@metamask/superstruct';
 import type { Infer } from '@metamask/superstruct';
 import { base64 } from '@metamask/utils';
@@ -29,6 +30,7 @@ import { KnownCaip2ChainId, KnownCaip2ChainIdStruct } from '../../api/network';
 import { Utf8StringStruct } from '../../api/string';
 import { UuidStruct } from '../../api/uuid';
 import { HashIdPreimageXdrStruct, XdrStruct } from '../../api/xdr';
+import { PRIVATE_KEY_EXPORT_ENCODING } from '../../constants';
 import { networkToCaip2ChainId } from '../../services/network/utils';
 
 /** JSON-RPC methods supported by this snap's multichain keyring. */
@@ -309,6 +311,29 @@ export const SignAuthEntryResponseStruct = union([
  */
 export const GetAccountRequestStruct = UuidStruct;
 
+/**
+ * Validation struct for the exportAccount request.
+ *
+ * Only {@link PRIVATE_KEY_EXPORT_ENCODING} (`base32`) is accepted. Missing
+ * `options` or `encoding` default to that encoding.
+ */
+export const ExportAccountRequestStruct = object({
+  accountId: UuidStruct,
+  options: defaulted(
+    object({
+      type: literal('private-key'),
+      encoding: defaulted(
+        enums([PRIVATE_KEY_EXPORT_ENCODING]),
+        PRIVATE_KEY_EXPORT_ENCODING,
+      ),
+    }),
+    {
+      type: 'private-key' as const,
+      encoding: PRIVATE_KEY_EXPORT_ENCODING,
+    },
+  ),
+});
+
 /**
  * Validation struct for the deleteAccount request.
  */
@@ -352,6 +377,11 @@ export type ResolveAccountAddressJsonRpcRequest = Infer<
  */
 export type GetAccountRequest = Infer<typeof GetAccountRequestStruct>;
 
+/**
+ * Type for the exportAccount request.
+ */
+export type ExportAccountRequest = Infer<typeof ExportAccountRequestStruct>;
+
 /**
  * Type for the deleteAccount request.
  */

@@ -18,6 +18,11 @@ import { StellarSnapException } from '../../utils/errors';
 
 export class KeyringException extends StellarSnapException {}
 
+/**
+ * Thrown when private-key export fails. Messages must not include the secret.
+ */
+export class ExportAccountException extends KeyringException {}
+
 /**
  * SEP-43 error codes.
  *