> ## Documentation Index
> Fetch the complete documentation index at: https://docs.riseworks.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Private Key Security

> Understanding and securing private keys for Rise B2B API

<Note>
  Understanding private keys is crucial for secure authentication and transaction signing in blockchain-based applications.
</Note>

<Warning>
  **A private key used with the Rise API can move money.** It's not only a login. Whoever holds the key of an authorized wallet can sign in as you and approve payments and withdrawals for every team that wallet's role reaches, and the Owner role can do everything the account can, including authorizing more wallets. Treat it like a production secret with access to funds: a dedicated wallet, stored in a secret manager or HSM, never in code, a repo, a log, or anything client-side. If it leaks, remove the wallet from **Security → Authorized Wallets** to revoke its on-chain role, then rotate to a new one. A leaked JWT expires in 24 hours; a leaked private key keeps working until you revoke the wallet.
</Warning>

## What is a Private Key?

A private key is a cryptographic secret that allows you to:

* **Sign messages** to prove your identity
* **Authorize transactions** on the blockchain
* **Control digital assets** associated with your wallet
* **Authenticate** with blockchain-based services

Think of it as a digital signature that only you can create, proving you are who you claim to be.

## How to Get Your Private Key

### From MetaMask

<Steps>
  <Step title="Open MetaMask">
    Click on the MetaMask extension in your browser
  </Step>

  <Step title="Access Account">
    Click on the three dots menu → Account details
  </Step>

  <Step title="Export Private Key">
    Click "Export Private Key" and enter your password
  </Step>

  <Step title="Copy Key">
    Copy the private key (starts with 0x)
  </Step>
</Steps>

### From Hardware Wallet

<Steps>
  <Step title="Connect Hardware Wallet">
    Connect your hardware wallet to your computer
  </Step>

  <Step title="Access Management">
    Use your wallet's management software
  </Step>

  <Step title="Export Key">
    Follow your wallet's export process
  </Step>

  <Step title="Verify Security">
    Ensure you're using a secure connection
  </Step>
</Steps>

### From Other Wallets

Most wallets provide an export function:

* **Trust Wallet**: Settings → Security → Export Private Key
* **Coinbase Wallet**: Settings → Advanced → Export Private Key
* **Rainbow**: Settings → Security → Export Private Key

### Generate New Key

```typescript theme={null}
import { ethers } from 'ethers';

// Generate a new wallet
const wallet = ethers.Wallet.createRandom();

// Get the private key
const privateKey = wallet.privateKey;
const address = wallet.address;

console.log('Private Key:', privateKey);
console.log('Address:', address);
```

## Private Key Security Best Practices

<CardGroup cols={2}>
  <Card title="Secure Storage" icon="lock">
    * Use password managers
    * Hardware security modules (HSM)
    * Encrypted storage
    * Never store in plain text
  </Card>

  <Card title="Access Control" icon="user-shield">
    * Limit access to authorized personnel
    * Use role-based access
    * Implement audit logging
    * Regular access reviews
  </Card>

  <Card title="Backup Strategy" icon="floppy-disk">
    * Create secure backups
    * Use multiple locations
    * Test recovery process
    * Update backups regularly
  </Card>

  <Card title="Monitoring" icon="eye">
    * Monitor wallet activity
    * Set up alerts
    * Regular security audits
    * Track usage patterns
  </Card>
</CardGroup>

## Private Key Format

Private keys in Ethereum are:

* **64 characters** long (32 bytes)
* **Hexadecimal** format
* **Start with 0x**
* **Case sensitive**

Example: `0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef`

## Why Private Keys Matter

Private keys are the foundation of blockchain-based security and provide several critical benefits:

<CardGroup cols={2}>
  <Card title="Cryptographic Security" icon="shield">
    * Mathematically unbreakable
    * Quantum-resistant algorithms
    * Zero-knowledge proofs
    * Tamper-evident signatures
  </Card>

  <Card title="User Control" icon="user">
    * You control your own identity
    * No reliance on third-party authentication
    * Direct ownership of digital assets
    * Self-sovereign identity
  </Card>

  <Card title="Audit Trail" icon="file-lines">
    * Blockchain-verifiable signatures
    * Immutable transaction history
    * Transparent audit logs
    * Compliance-ready records
  </Card>

  <Card title="Compliance" icon="circle-check">
    * Self-sovereign identity
    * Regulatory compliance
    * Audit trail requirements
    * Data privacy standards
  </Card>
</CardGroup>

## Private Key vs Traditional Authentication

| Feature         | Private Key (Blockchain) | Traditional Authentication |
| --------------- | ------------------------ | -------------------------- |
| **Security**    | Cryptographic signatures | Password-based             |
| **Control**     | User owns the key        | Provider controls access   |
| **Recovery**    | Self-managed backup      | Provider-dependent         |
| **Portability** | Works across platforms   | Platform-specific          |
| **Audit Trail** | Blockchain-verifiable    | Provider logs              |
| **Compliance**  | Self-sovereign           | Provider compliance        |

## Getting Started with Private Keys

If you're new to blockchain-based authentication, follow these steps:

<Steps>
  <Step title="Choose a Wallet">
    Select a wallet that supports private key export
  </Step>

  <Step title="Export Private Key">
    Follow your wallet's export process
  </Step>

  <Step title="Secure Storage">
    Store the private key securely using environment variables
  </Step>

  <Step title="Test Integration">
    Test with staging environment first
  </Step>

  <Step title="Monitor Usage">
    Set up monitoring and alerts
  </Step>
</Steps>

**Security Recommendation**: Use a dedicated secondary wallet for API operations. This wallet should contain minimal funds and be used exclusively for signing API transactions, keeping your primary wallet secure.

## Environment Variables

```bash theme={null}
# .env file
PRIVATE_KEY=0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
RISE_ID=0x1234567890123456789012345678901234567890
```

```typescript theme={null}
// TypeScript configuration
const client = new RiseApiClient({
  environment: 'prod',
  riseIdAuth: {
    riseId: process.env.RISE_ID,
    privateKey: process.env.PRIVATE_KEY
  }
});
```