> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kiwify.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Generation

> How to generate an Ed25519 keypair for API authentication

# Generating a Keypair

The Banking API uses EdDSA authentication with Ed25519 keys. You need to generate a keypair (public and private) before creating a service account.

<Warning>
  Never share your private key. Store it securely. You'll need it to sign all API requests.
</Warning>

## Method 1: Online Tool (Easiest)

Use our online tool to generate keys directly in your browser:

<Card title="Generate Keys Online" icon="key" href="https://conta.kiwify.com/public/generate-keys">
  Generate an Ed25519 keypair instantly in your browser
</Card>

The private key is generated locally in your browser - it's never sent to our servers.

## Method 2: Terminal (Recommended)

Use the `ssh-keygen` command to generate keys:

```bash theme={null}
ssh-keygen -t ed25519 -f service-account-key -N ""
```

This creates two files:

* `service-account-key` - Private key (store securely)
* `service-account-key.pub` - Public key (used for registration)

To view the public key:

```bash theme={null}
cat service-account-key.pub
```

Expected output:

```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... your-user@your-computer
```

## Method 3: OpenSSL

```bash theme={null}
# Generate private key
openssl genpkey -algorithm Ed25519 -out private.pem

# Extract public key
openssl pkey -in private.pem -pubout -out public.pem
```

<Note>
  To use with the API, you'll need to convert the public key to OpenSSH format (`ssh-ed25519 ...`).
</Note>

## Method 4: Programmatically

### Node.js

```javascript theme={null}
import { generateKeyPairSync } from 'crypto';
import { writeFileSync } from 'fs';

const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
  publicKeyEncoding: { type: 'spki', format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
});

writeFileSync('private.pem', privateKey);
writeFileSync('public.pem', publicKey);
```

### Python

```python theme={null}
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives import serialization

private_key = Ed25519PrivateKey.generate()
public_key = private_key.public_key()

# Save private key
with open("private.pem", "wb") as f:
    f.write(private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption()
    ))

# Save public key
with open("public.pem", "wb") as f:
    f.write(public_key.public_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PublicFormat.SubjectPublicKeyInfo
    ))
```

## Public Key Format

The API accepts public keys in OpenSSH format:

```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... optional-comment
```

| Part          | Description                  |
| ------------- | ---------------------------- |
| `ssh-ed25519` | Algorithm type               |
| `AAAAC3...`   | Base64-encoded key           |
| `comment`     | Optional, for identification |

## Next Step

After generating keys, create a service account in the dashboard:

<Card title="Create Service Account" icon="user-plus" href="/api-reference/banking/service-accounts">
  Configure permissions and allowed IPs in the Conta Digital dashboard
</Card>