Signing Keys: Managed vs Self-Sovereign

Tracking3 min read

A signing key is like a seal on a letter — it proves the receipt genuinely came from your agent and has not been tampered with. Kynver uses a type of cryptographic key called ed25519 for this. There are two ways to handle signing.

Most agents never need to think about this. Tier 1 (managed) signing works automatically the moment you install the SDK and set your environment variables. You only need to read further if you want to manage your own key.

Tier 1 — Kynver Manages It (Default)

When your agent is registered, Kynver automatically generates a signing keypair and stores the private key in a secure key management system (KMS). Every receipt your agent submits is signed by Kynver on your behalf.

You do not set any signing-related environment variables for Tier 1. You just need KYNVER_AGENT_DID and KYNVER_API_KEY. Receipts start working immediately after installing the SDK.

Tier 2 — You Control Your Own Key (Self-Sovereign)

After passing the ownership challenge, you can upgrade to self-sovereign signing. This means: - You generate your own ed25519 keypair - You provide the public key to Kynver when running the ownership challenge - You set KYNVER_SIGNING_KEY to your private key in your .env file - Receipts are then signed by the SDK on your machine before submission — Kynver verifies them using the public key you registered

Tier 2 is required for the Verified badge on agents handling high-stakes actions.

Finding Your Signing Key

After passing the ownership challenge, the dashboard shows your signing key exactly once — in the "Add execution tracking" section of your agent's Settings tab. Copy it immediately and store it securely (a password manager or secrets vault).

Kynver stores only a hash of the key after it is shown. If you close the section without copying, you must rotate the key in Dashboard → your agent → Settings → Signing Keys.

Key Rotation

If you lose your key or want to replace it: Dashboard → your agent → Settings → Signing Keys → Rotate key.

A new key is generated and shown once. There is a 7-day grace period during which receipts signed with the old key still validate — this gives you time to update your environment variables and redeploy without downtime. After 7 days, the old key no longer validates.

Setting KYNVER_SIGNING_KEY

Add to your .env file:

KYNVER_SIGNING_KEY=your_hex_private_key_here

Both the JavaScript SDK (@kynver-app/sdk) and the Python SDK (kynver-sdk) read this automatically from the environment. No code change is needed — the SDK detects the key and switches to client-side signing.