> ## Documentation Index
> Fetch the complete documentation index at: https://docs.autheo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Key management

> Managing operator and consensus keys on Autheo Chain: keyring backends, the eth_secp256k1 algorithm, address formats, and security best practices.

Autheo Chain uses `eth_secp256k1` — the same elliptic curve as Ethereum. A single private key controls both your Cosmos address (`autheo1...`) and your Ethereum address (`0x...`), enabling native compatibility with hardware wallets and MetaMask.

## Two key types

| Key           | Purpose                                                  | Location                               |
| ------------- | -------------------------------------------------------- | -------------------------------------- |
| Operator key  | Signs staking, governance, and all on-chain transactions | Keyring (file, OS, or hardware wallet) |
| Consensus key | Signs block proposals for CometBFT consensus             | `config/priv_validator_key.json`       |

A compromised operator key allows an attacker to drain your delegated funds. A compromised consensus key can cause permanent tombstoning from double-signing.

## Keyring backends

| Backend | Security | Use case                                                          |
| ------- | -------- | ----------------------------------------------------------------- |
| `file`  | Medium   | Headless production servers (AES-encrypted, passphrase-protected) |
| `os`    | High     | Production with OS keystore integration                           |
| `pass`  | High     | Advanced Linux setups using GPG                                   |
| `test`  | None     | Development only — never in production                            |

## Creating a key

```bash theme={null}
autheod keys add mykey \
  --keyring-backend file \
  --home /path/to/node-home
```

<Warning>
  Save the 24-word mnemonic phrase immediately. It is displayed only once. There is no way to recover it afterward. Store it offline in encrypted storage.
</Warning>

## Restoring a key from mnemonic

```bash theme={null}
autheod keys add <key-name> \
  --recover \
  --keyring-backend file \
  --home /path/to/node-home
```

## Viewing address formats

Each key has three equivalent address representations:

```bash theme={null}
# Cosmos address (autheo1...)
autheod keys show mykey --keyring-backend file

# Validator operator address (autheovaloper1...)
autheod keys show mykey --bech val --keyring-backend file

# Ethereum hex address (0x...)
autheod keys show mykey --bech eth --keyring-backend file
```

The `autheovaloper1...` address is derived from the same 20 bytes as `autheo1...` — only the Bech32 prefix differs.

## Consensus key

Generated automatically during `autheod init`, stored in `config/priv_validator_key.json`.

```bash theme={null}
# Get public key for MsgCreateValidator
autheod tendermint show-validator --home /path/to/node-home
```

Back up this file immediately to encrypted offline storage. If duplicated on another running node, double-signing causes permanent tombstoning.

## Remote signing (production recommendation)

Keep the consensus key off the validator host entirely using `tmkms` or an HSM:

```toml theme={null}
# config/config.toml
[consensus]
priv_validator_laddr = "tcp://127.0.0.1:26658"
```

## Hardware wallet support

Autheo Chain's `eth_secp256k1` key algorithm is compatible with Ledger and Trezor. Use the `--ledger` flag with key commands when a hardware wallet is connected.

## Key security checklist

* [ ] Mnemonic backed up to offline encrypted storage
* [ ] `priv_validator_key.json` backed up separately from the mnemonic
* [ ] `--keyring-backend test` never used in production
* [ ] Consensus key protected by remote signer or HSM
* [ ] Keyring password stored separately from the encrypted keystore file
* [ ] No key files committed to version control