Skip to main content

Using Keystone Hardware Wallets with the Solana CLI

This page explains how to use a Keystone device to interact with Solana via the command line.

Prerequisites​

Using Keystone with the Solana CLI​

  1. Connect your Keystone device to your computer via USB
  2. Unlock the device
  3. Ensure the device is ready to interact

View Wallet Address​

Run the following command on your computer:

solana-keygen pubkey usb://keystone?key=0/0

This returns the first external (receive) Solana address on the Keystone device, corresponding to the BIP-44 path m/44'/501'/0'/0'.

You can derive different addresses by changing the key= path. For example:

solana-keygen pubkey usb://keystone?key=0/0
solana-keygen pubkey usb://keystone?key=0/1
solana-keygen pubkey usb://keystone?key=1/0
solana-keygen pubkey usb://keystone?key=1/1

All of these addresses can be used as receive addresses; the corresponding private keys always remain on the Keystone device and are used to sign transactions. Remember the keypair URL you use so you can sign transactions with it later.

Wallet Operations​

For checking balances, transferring funds, and other operations, see View Your Balance and Send SOL. Replace ledger with keystone in the examples and use your own keypair URL.

Troubleshooting​

Linux USB permissions​

On Linux, you may need development headers and a udev rule before the CLI can open the Keystone USB device.

Install the required system packages:

sudo apt-get install build-essential libudev-dev

Create a Keystone udev rule:

echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="3001", MODE="0660", GROUP="plugdev"' | sudo tee /etc/udev/rules.d/99-keystone.rules

Reload udev rules:

sudo udevadm control --reload-rules
sudo udevadm trigger

Disconnect and reconnect the Keystone device after reloading the rules.

? is ignored in zsh​

? is a special character in zsh. If you do not rely on this feature, you can add the following to your ~/.zshrc:

unsetopt nomatch

Then run:

source ~/.zshrc

Or escape the ? in the URL:

solana-keygen pubkey usb://keystone\?key=0/0

Support​

For more help, visit Solana StackExchange.

For more examples, see: Transfer Tokens, Delegate Stake. You can use usb://keystone anywhere a <KEYPAIR> argument is accepted.