Account Key

Overview

Meaning and scope

An account key is a cryptographic key, public key, key pair, or protocol-specific key reference used to identify or authorize actions for a blockchain account. The private component may create signatures, while the public component can support address derivation or verification. Not every account has a private key, and one account can use several keys with different permissions.

Mechanism and operation

An account key connects cryptographic control to a blockchain account. In a simple externally controlled account, a private key signs transactions and the corresponding public key or derived address identifies the account. Contract accounts, program-derived accounts, and multisignature accounts may have no single private key. An Account Authority may grant one key spending rights and another key administrative rights. The key’s algorithm, network domain, permitted actions, and activation period determine what a valid signature can authorize. Operational security focuses on the private or secret component. It should be generated with approved randomness, protected in hardware or an appropriate custody system, backed up according to recovery policy, and never exposed in logs or application code.

Practical payment example

A service rotates a signing key used to authorize account actions. Its audit trail links the old and new public keys to the same account authority without storing unencrypted private material.

Operational checks

Rotation may require an on-chain transaction and can be impossible for addresses permanently derived from one public key. Teams should test replacement and disaster-recovery procedures before the key becomes critical. Payment systems should record key fingerprints or public identifiers without storing unnecessary secrets. A successful Signature Verification proves that a matching key signed specific bytes, but not that the key was used by the intended human or under an approved workflow.

Distinctions and limits

Their authority comes from code, multiple signers, or protocol rules rather than one secret that directly controls the address. The phrase can refer to different objects across systems: a signing key, public key, account identifier, validator key, session key, or key stored in an account configuration.

Related reading

Related definitions: account, Account Authority.