Key management

Autheo Chain uses eth_secp256k1 — the same elliptic curve as Ethereum. A single private key controls both your Cosmos address (autheo1...) and your Ethereum address (0x...), enabling native compatibility with hardware wallets and MetaMask.

Two key types

Key	Purpose	Location
Operator key	Signs staking, governance, and all on-chain transactions	Keyring (file, OS, or hardware wallet)
Consensus key	Signs block proposals for CometBFT consensus	`config/priv_validator_key.json`

A compromised operator key allows an attacker to drain your delegated funds. A compromised consensus key can cause permanent tombstoning from double-signing.

Keyring backends

Backend	Security	Use case
`file`	Medium	Headless production servers (AES-encrypted, passphrase-protected)
`os`	High	Production with OS keystore integration
`pass`	High	Advanced Linux setups using GPG
`test`	None	Development only — never in production

Creating a key

autheod keys add mykey \
  --keyring-backend file \
  --home /path/to/node-home

Save the 24-word mnemonic phrase immediately. It is displayed only once. There is no way to recover it afterward. Store it offline in encrypted storage.

Restoring a key from mnemonic

autheod keys add <key-name> \
  --recover \
  --keyring-backend file \
  --home /path/to/node-home

Viewing address formats

Each key has three equivalent address representations:

# Cosmos address (autheo1...)
autheod keys show mykey --keyring-backend file

# Validator operator address (autheovaloper1...)
autheod keys show mykey --bech val --keyring-backend file

# Ethereum hex address (0x...)
autheod keys show mykey --bech eth --keyring-backend file

The autheovaloper1... address is derived from the same 20 bytes as autheo1... — only the Bech32 prefix differs.

Consensus key

Generated automatically during autheod init, stored in config/priv_validator_key.json.

# Get public key for MsgCreateValidator
autheod tendermint show-validator --home /path/to/node-home

Back up this file immediately to encrypted offline storage. If duplicated on another running node, double-signing causes permanent tombstoning.

Remote signing (production recommendation)

Keep the consensus key off the validator host entirely using tmkms or an HSM:

# config/config.toml
[consensus]
priv_validator_laddr = "tcp://127.0.0.1:26658"

Hardware wallet support

Autheo Chain’s eth_secp256k1 key algorithm is compatible with Ledger and Trezor. Use the --ledger flag with key commands when a hardware wallet is connected.

Key security checklist

Mnemonic backed up to offline encrypted storage
priv_validator_key.json backed up separately from the mnemonic
--keyring-backend test never used in production
Consensus key protected by remote signer or HSM
Keyring password stored separately from the encrypted keystore file
No key files committed to version control

Start Here

Getting Started

Web Apps

Developers

APIs

Node operations

SDKs

Papers

Two key types

Keyring backends

Creating a key

Restoring a key from mnemonic

Viewing address formats

Consensus key

Remote signing (production recommendation)

Hardware wallet support

Key security checklist

​Two key types

​Keyring backends

​Creating a key

​Restoring a key from mnemonic

​Viewing address formats

​Consensus key

​Remote signing (production recommendation)

​Hardware wallet support

​Key security checklist

Two key types

Keyring backends

Creating a key

Restoring a key from mnemonic

Viewing address formats

Consensus key

Remote signing (production recommendation)

Hardware wallet support

Key security checklist