Keys, pre-flight and connections

Create your keys on the machine, check it before you start, and connect to other nodes with signed connections.

Testnet only · the test network's node release; the same tools come to the main network in a later release

The node binary carries three tools: <node binary> keygen creates the keys on the machine, <node binary> preflight checks the machine and the release before you start, and the [p2p] settings decide how your node connects to other nodes. Download and verify the release first, as Run a node describes.

Create your keys

Create each key on the machine that will use it. A key file is never copied in from somewhere else.

Bash

<node binary> keygen validator --out <file>  # the validator key: signs blocks, votes and connections
<node binary> keygen vrf --out <file>        # the VRF key a validator also needs
<node binary> keygen node --out <file>       # the identity of a full node or a sentry

Each command writes a new file that only its owner can read (mode 600). It never writes over a file that already exists.
It prints only public values: the address and the public key, or the VRF public key.
One key runs on one machine only. Never start the same validator key on two machines.

A validator needs a validator key and a VRF key. A full node or a sentry needs a node key.

Check the machine before you start

Bash

<node binary> preflight

Run it on the machine that will run the node, with the node's settings file in place, the same way you start the node. It prints one line per item — PASS, FAIL or NOT CHECKED — with the reason in plain words, and exits with 0 only when nothing failed. A NOT CHECKED line means it could not check that item; read its reason before you start.

Item	`PASS` means	If it says `FAIL`
config	the settings file reads and has what the node needs	start again from the release's settings template and fix the line the reason names
genesis	the genesis file is the one this release was built for	download the testnet's genesis file again and check its hash (see Run a node)
release signature	`SHA256SUMS` is signed by the release key `C5EB…48AE`, and this binary is listed in it	download the release again and check it; never start a binary that fails this check
key files	every key file the settings name is there and readable only by its owner	create the missing key with `<node binary> keygen`, or make the file readable only by you (`chmod 600`)
ports	the ports the node listens on are free	stop whatever else uses the port, or set another port in the settings
clock	the machine's clock is kept in time by NTP	switch on time synchronisation (for example `timedatectl set-ntp true`)
disk	there is enough free disk space for the node	free space, or move the node's data to a larger disk
peers	the peers and seeds in the settings answer	check the addresses, and that your firewall lets the node connect out

Connect to other nodes

The [p2p] section of the settings decides how your node connects:

TOML

[p2p]
class = "full"                   # validator | sentry | full
peer_auth = "require"            # off | log | require
public_listen = "0.0.0.0:9010"   # optional: where full nodes and sentries connect to this node
node_key_file = "<node key>"     # a full node or sentry: the key from `<node binary> keygen node`
seeds_file = "<seeds file>"      # the nodes to connect to first

Node classes

validator — a validator. It connects to other validators as a validator only with the validator key recorded for its seat.
sentry and full — nodes without a seat. They connect with their node key.

A full node may ask other nodes only for blocks, state and the addresses of other nodes. Validators' addresses are never shared when nodes exchange addresses.

Signed connections

Every connection starts with a signed handshake. The two nodes agree on a key (X25519), each proves its node identity by signing, and from then on the session is encrypted and every message is checked. peer_auth decides what your node does with a connection whose handshake does not check out:

`peer_auth`	What your node does
`off`	does not check the handshake
`log`	checks it, keeps the connection and logs the failure
`require`	checks it and refuses a connection that fails

You can change peer_auth while the node runs: the change applies within about 15 seconds, with no restart. The network announces when to move from log to require.

Seeds

The seeds file lists the nodes your node connects to first. Each entry is a node's address and its node identity:

JSON

[{"addr": "host:port", "id": "0x…"}]

The node checks that each seed proves that identity in its handshake.

The public listener

public_listen is optional. Set it on a full node or a sentry that other full nodes and sentries should connect to. A validator connects to the other validators with the addresses it is given when it is accepted.

Network facts last checked against the network 2026-10-24 02:30:01 UTC · mainnet spec v28 · testnet spec v8