{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/v1.40/concepts/generate-keys-register","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/concepts/generate-keys-register","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/concepts/generate-keys-register","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/concepts/generate-keys-register","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/concepts/generate-keys-register","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/concepts/generate-keys-register","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/concepts/generate-keys-register","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","tabs","tab"]},"type":"markdown"},"seo":{"title":"Generate keys and register","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"generate-keys-and-register","__idx":0},"children":["Generate keys and register"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Every user needs a cryptographic key pair. This one-time setup generates your keys and registers your public key with the platform."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Generate a key pair using a cryptographically secure method (P-256, secp256k1, or Ed25519)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keep your private key secret. Share only the public key with your administrator."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your public key is registered via governance intent (or genesis block for initial users)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Production keys should be generated and stored in a secure KMS, not manually."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your key pair is your digital identity on the platform. The private key proves you authorized every action you take — losing it means losing access, and exposing it means someone else can act as you. There is no \"forgot password\" recovery — key management is the user's responsibility."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["For architects and operators"]},": Establish key generation procedures and secure storage guidance for your users. Consider mandating hardware security keys (YubiKey) or the mobile app's secure enclave for production users rather than software-based key storage."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide is for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["regular users"]}," who need to register after the platform is running. Genesis users are pre-configured during platform initialization — see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/concepts/genesis-state"},"children":["Genesis block"]}," for details."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":1},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access to a cryptographically secure environment for key generation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Contact information for your user administrator"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Knowledge of which key type your environment requires (ask your administrator if unsure)"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"supported-key-types","__idx":2},"children":["Supported key types"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," supports three types of cryptographic keys:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Key type"},"children":["Key type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Curve"},"children":["Curve"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Common use"},"children":["Common use"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"When to choose"},"children":["When to choose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["P-256 (secp256r1)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["NIST P-256"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["General purpose, widely supported"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Default choice for most deployments"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["secp256k1"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Koblitz curve"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bitcoin, Ethereum ecosystems"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When integrating with Bitcoin/Ethereum infrastructure"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ed25519"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Edwards curve"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["High performance, modern systems"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When performance is critical"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All keys must be in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DER format with Base64 encoding"]}," (without PEM headers/footers)."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ask your administrator which key type is required for your environment before generating keys. Using the wrong key type will cause authentication failures."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-generate-a-key-pair","__idx":3},"children":["Step 1: Generate a key pair"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Generate a key pair using a cryptographically secure method. The private key must be kept secret; the public key will be shared with your administrator."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Production environments"]},": Always generate and store production keys using a cryptographically secure key management system (KMS). The OpenSSL examples below are for testing and development only."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"openssl-examples-non-production","__idx":4},"children":["OpenSSL examples (non-production)"]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"P-256 (secp256r1)","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"# Generate private key\nopenssl ecparam -genkey -name secp256r1 -noout -out privateKey.pem\n\n# Export public key in DER format with Base64 encoding\nopenssl ec -in privateKey.pem -pubout -outform DER | openssl base64 -A -out publicKey.pem\n","lang":"sh"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"secp256k1","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"# Generate private key\nopenssl ecparam -genkey -name secp256k1 -noout -out privateKey.pem\n\n# Export public key in DER format with Base64 encoding\nopenssl ec -in privateKey.pem -pubout -outform DER | openssl base64 -A -out publicKey.pem\n","lang":"sh"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Ed25519","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"# Generate private key\nopenssl genpkey -algorithm Ed25519 -out privateKey.pem\n\n# Export public key in DER format with Base64 encoding\nopenssl pkey -in privateKey.pem -pubout -outform DER | openssl base64 -A -out publicKey.pem\n","lang":"sh"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"view-your-keys","__idx":5},"children":["View your keys"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To view the private key (keep this secret):"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"cat privateKey.pem\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example output:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIEfoycax3w8+JvkNv+L0CHmNUAHUcgCxlnOIpw/CoXzxoAoGCCqGSM49\nAwEHoUQDQgAEg36xU2KQ6xLPCvZ3JXZYf5pFCagAb7WGMlYCN92zzgi737EOkDOC\nMlZB0TY8CbzRHhG4RUdKuLkdRtD+OVIu2w==\n-----END EC PRIVATE KEY-----\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To view the public key (this is what you share):"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"cat publicKey.pem\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example output:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEg36xU2KQ6xLPCvZ3JXZYf5pFCagAb7WGMlYCN92zzgi737EOkDOCMlZB0TY8CbzRHhG4RUdKuLkdRtD+OVIu2w==\n"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-register-with-your-administrator","__idx":6},"children":["Step 2: Register with your administrator"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Send your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["public key"]}," to your user administrator through a secure channel. Never share your private key."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your administrator will:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateUser"]}," intent with your public key"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Submit the intent for governance approval (based on configured policies)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Notify you once your account is active"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-verify-your-registration","__idx":7},"children":["Step 3: Verify your registration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After your administrator confirms your account is active, verify your registration by calling the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/api/reference/openapi/users/getuser"},"children":["Get user details"]}," API operation."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Obtain a JWT token. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/concepts/authenticate-api-requests"},"children":["Authenticate API requests"]}," for the complete JWT flow."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Call the Get current user endpoint with your JWT:"]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"GET /v1/users/current\nAuthorization: Bearer <your_jwt_token>\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":3},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify the response contains your user ID, public key, and domain memberships:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"id\": \"user_abc123\",\n  \"domains\": [\"domain_xyz789\"],\n  \"publicKey\": \"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you receive a successful response, your registration is complete."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":8},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Problem"},"children":["Problem"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Resolution"},"children":["Resolution"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key generation fails"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenSSL not installed or outdated"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Install or update OpenSSL"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Public key rejected by administrator"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Wrong key type or format"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verify key type matches environment requirements; ensure DER format with Base64 encoding"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Registration not completing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intent awaiting approval"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Contact your administrator to check approval status"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cannot authenticate after registration"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Account not yet active"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Wait for administrator confirmation; check intent status"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":9},"children":["Next steps"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once registered, proceed to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/concepts/authenticate-api-requests"},"children":["Authenticate API requests"]}," to learn how to obtain JWT tokens and sign intents for ongoing API usage."]}]},"headings":[{"value":"Generate keys and register","id":"generate-keys-and-register","depth":1},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Supported key types","id":"supported-key-types","depth":2},{"value":"Step 1: Generate a key pair","id":"step-1-generate-a-key-pair","depth":2},{"value":"OpenSSL examples (non-production)","id":"openssl-examples-non-production","depth":3},{"value":"View your keys","id":"view-your-keys","depth":3},{"value":"Step 2: Register with your administrator","id":"step-2-register-with-your-administrator","depth":2},{"value":"Step 3: Verify your registration","id":"step-3-verify-your-registration","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"Generate keys and register"}},"lastModified":"2026-04-07T19:14:09.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.34/concepts/generate-keys-register","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}