> ## Documentation Index
> Fetch the complete documentation index at: https://developers.bloobank.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate your keys

> Create an ECDSA secp256k1 keypair on your infrastructure and register the public half with BlooBank.

The Access Protocol uses an asymmetric keypair on the `secp256k1` curve. You generate the keypair locally; only the **public** half ever leaves your environment.

## Step 1 — Install OpenSSL

OpenSSL ships preinstalled on macOS and most Linux distributions. On Windows, install the version that ships with Git for Windows or grab a build from [openssl.org](https://www.openssl.org/source/).

```bash theme={"dark"}
openssl version
# LibreSSL 3.3.6  or  OpenSSL 3.x.x
```

## Step 2 — Generate the private key

```bash theme={"dark"}
openssl ecparam -name secp256k1 -genkey -out privateKey.pem
```

This writes `privateKey.pem` to your working directory.

<Warning>
  **The private key is your secret.** Never commit it, never paste it into chat, never send it — not even to BlooBank. Store it in a secret manager (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault, Doppler) or an encrypted environment variable. Add `*.pem` and `.env` to `.gitignore` from the start.
</Warning>

## Step 3 — Extract the key pair in hex

BlooBank expects the public key in **hexadecimal**. Dump the PEM as text and extract both halves:

```bash theme={"dark"}
openssl ec -in privateKey.pem -noout -text
```

Sample output:

```text theme={"dark"}
Private-Key: (256 bit)
priv:
    7c:d5:f4:99:a5:fd:de:62:83:09:96:96:b8:8b:51:
    70:e4:8d:85:ab:23:eb:58:bf:c0:e4:99:6b:ac:0c:
    3f:76
pub:
    04:94:cc:f0:38:2d:a3:c3:21:f5:cb:e8:59:06:8c:
    8c:91:4d:6a:d5:ce:17:ab:3d:26:a9:dd:7f:ff:65:
    78:cb:31:62:e0:75:af:bd:98:45:96:4a:0c:13:e4:
    39:ae:53:78:30:49:8f:ef:58:79:45:59:7e:97:0a:
    b2:7c:14:7c:23
ASN1 OID: secp256k1
```

Strip colons and newlines to get flat hex strings:

<CodeGroup>
  ```bash macOS / Linux theme={"dark"}
  # Private key (32 bytes → 64 hex chars)
  openssl ec -in privateKey.pem -noout -text 2>/dev/null \
    | awk '/priv:/{flag=1; next} /pub:/{flag=0} flag' \
    | tr -d ' :\n'

  # Public key (uncompressed, 65 bytes → 130 hex chars, starts with 04)
  openssl ec -in privateKey.pem -noout -text 2>/dev/null \
    | awk '/pub:/{flag=1; next} /ASN1/{flag=0} flag' \
    | tr -d ' :\n'
  ```

  ```javascript Node.js theme={"dark"}
  import { execSync } from "node:child_process";

  const txt = execSync("openssl ec -in privateKey.pem -noout -text", {
    stdio: ["ignore", "pipe", "ignore"],
  }).toString();

  const grab = (start, end) =>
    txt.split(start)[1].split(end)[0].replace(/[\s:]/g, "");

  const privHex = grab("priv:", "pub:");
  const pubHex  = grab("pub:", "ASN1 OID");

  console.log({ privHex, pubHex });
  ```

  ```python Python theme={"dark"}
  import re, subprocess

  out = subprocess.check_output(
      ["openssl", "ec", "-in", "privateKey.pem", "-noout", "-text"],
      stderr=subprocess.DEVNULL,
  ).decode()

  def grab(start, end):
      chunk = out.split(start, 1)[1].split(end, 1)[0]
      return re.sub(r"[\s:]", "", chunk)

  priv_hex = grab("priv:", "pub:")
  pub_hex  = grab("pub:", "ASN1 OID")
  print({"priv": priv_hex, "pub": pub_hex})
  ```
</CodeGroup>

Example public key (valid format — 130 hex chars, uncompressed, leading `04`):

```text theme={"dark"}
0494ccf0382da3c321f5cbe859068c8c914d6ad5ce17ab3d26a9dd7fff6578cb3162e075afbd9845964a0c13e439ae537830498fef587945597e970ab27c147c23
```

## Step 4 — Register the public key

<Steps>
  <Step title="Copy the public key hex">
    The 130-character string starting with `04` from Step 3.
  </Step>

  <Step title="Send it to your BlooBank integration contact">
    Share the public key through the channel established during onboarding. **Never share the private key** — only the public half is needed.
  </Step>

  <Step title="Receive your Access Key">
    BlooBank registers the public key and returns an Access Key. Store it together with your private-key hex in your secret store — both are required to sign requests.
  </Step>
</Steps>

<Check>
  You now have **three secrets** to manage: the private key (most sensitive), the Access Key (sensitive — identifies you), and the public key (not sensitive, but worth keeping near the others for reference).
</Check>

## Per-environment separation

Use **distinct keypairs for sandbox, staging, and production**. Never reuse a staging key in production. A compromise in one environment must not cascade.

## Rotation

Rotate keys every 6–12 months, or immediately if you suspect compromise:

1. Generate a new keypair on the new environment.
2. Send the new public key to BlooBank; you will receive a **new** Access Key.
3. Cut over traffic to the new credential.
4. Request revocation of the old credential.

There is no in-place key rotation — every rotation produces a new Access Key. This is intentional: revocation is unambiguous.

## Next

<Card title="Sign a request" icon="signature" href="/get-started/authentication/sign-request" horizontal>
  Use the keypair you just generated to sign your first authenticated request.
</Card>