BC9: Apps that talk to the chain
Keys and signers in apps
🎯You'll be able to
Keep signing keys out of code and repositories, and choose who signs: the user's wallet or a server.
🏠The everyday picture
A shop's safe key isn't taped to the till. It's kept by the manager, and only the manager opens the safe.
📘What it really is
-
Users sign in their own wallet: on a website, the browser wallet signs; the site doesn't see the key. This is usually the right design.
-
Scripts and servers: when an app must sign itself, read the key from an environment variable or a secrets manager, not from code.
.envfiles: keep local settings in.env, list it in.gitignore, and commit a.env.examplewith empty values.- Practice accounts are public: the practice network's test keys are printed for everyone. Don't use them elsewhere.
- Scanning: check code and documents for anything that looks like a 64-character hex key before committing.
- Rotation: a key that was ever in a repository counts as exposed; replace it.
📝A worked example
Input: the starter's app/lib.js has a key in a constant.
Steps:
- Remove the constant.
loadWallet(env, provider)readsenv.SAKHI_PRIVATE_KEY. - If it's missing, throw "No key found. Set SAKHI_PRIVATE_KEY in your .env file", without printing any key.
- Add
.envto.gitignore, and keep.env.examplewith an empty value.
Expected output: no key in the project, and a helpful message when it's not set.
🌍Where it's used
- Treasury bots with keys in secrets managers.
- Deploy scripts reading keys from the environment.
- Websites that don't hold users' keys.
📝Case scenario
A developer pushed a script with a private key to a public repository "for a minute". Automated bots that scan new commits took the
account's funds within seconds. Removing the commit didn't help, as the key had already been copied. A key read from .env wouldn't
have been committed.
🖱️Try it
Search the starter's app/ folder for anything that looks like a key, with your editor's search for a 64-character hex pattern.
Success: you find DEMO_KEY and can say why it must go.
⚠️Common mistakes
- Keys in code. Sign: a hex constant. Fix: environment variables.
- Printing keys in errors. Sign: logs with keys. Fix: messages without secrets.
- Practice keys on public networks. Sign: funds taken at once. Fix: fresh keys.
🛠️For your project
Project 3's test 2 checks the key comes from the environment and that no file in app/, docs/ or scripts/ holds one.
✅Quick check
Who should sign transactions on a website?
Show the answer
The user's own wallet, so the site doesn't see their key.
What should you assume about a key that was ever committed to a repository?
Show the answer
That it's exposed, and replace it.