SIGNER KEY GENERATION, OFFLINE ONLYSENSITIVE

Signer key helper

Generates the key material for the signer: a BIP39 seed phrase, its account-index-0 Stacks address, the account-index-0 private key, and the compressed public key. This is a distinct identity from your funded, hardware-backed/multisig-backed manager-admin wallet, and it lives on the signer node, so keep the two isolated.

Read before using. A browser is not the ideal place to make a production seed phrase. The preferred path is the node host, offline (for example stacks-cli make_keychain, or your standard BIP39 tooling), then place the key in the signer config per the signer guide. Use this page only if you can run it fully offline or air-gapped: after the libraries load once, turn off Wi-Fi, generate, write the seed phrase down on paper, transfer the key by a trusted channel, then wipe the clipboard and this tab. Never paste the seed phrase or private key into a website, the other dApps in this set, chat, or email. The other dApps only ever need the public key or the address. This mirrors your organisation's key-handling policy for signing keys.

Network state

This tab currently reports as: checking

I have disconnected this machine from the network (or accept the risk on a throwaway testnet key). I understand this seed and key go on the signer node and must be kept separate from my funded, hardware-wallet key.

Seed length:

Master seed phrase (BIP39), write this down

Account index 0

Stacks address, testnet (ST…)

Stacks address, mainnet (SP…)

Private key (66 hex, for signer config)

Compressed public key (used by register-self and the grant)

Derivation path m/44'/5757'/0'/0/0 via @stacks/wallet-sdk. The address is the same account on both networks, so fund the ST… form for the PoX-5 testnet. Confirm the private-key format your signer build expects.

Signer config field (verify against your signer version)

Signer grant JSON (advanced, testing)

Mostly for testing. This computes the register-self grant signature in the browser, so it needs the signer private key here. On a real signer you generate it on the node with stacks-signer generate-staking-signature and the key never leaves the host. It also works for mainnet, but you generally should not need it there.

Network (sets the domain chain-id; the signature is network-specific) Signer private key (64 hex, or 66 hex with the 01 flag)

Signer-manager principal auth-id (reuse this exact value when you register)

Message hash (should match PoX-5 get-signer-grant-message-hash)

Signer public key (derived from the key)

Signer output JSON, paste into dApp 4

dApp 4 independently re-fetches the live hash from PoX-5 and blocks broadcast unless this signature verifies against it, so a wrong entry here fails safely.

Crypto libraries load once at startup; after that first load, disconnect before generating. Even on testnet the keys-never-touch-a-website habit is kept, so the pattern is safe when promoted to mainnet. Signer Sidekick is interim tooling.