Account Key

Overview

An account key connects cryptographic control to a blockchain account. In a simple externally controlled account, a private key signs transactions and the corresponding public key or derived address identifies the account. Contract accounts, program-derived accounts, and multisignature accounts may have no single private key. Their authority comes from code, multiple signers, or protocol rules rather than one secret that directly controls the address.

The phrase can refer to different objects across systems: a signing key, public key, account identifier, validator key, session key, or key stored in an account configuration. These should not be treated as interchangeable. An Account Authority may grant one key spending rights and another key administrative rights. The key’s algorithm, network domain, permitted actions, and activation period determine what a valid signature can authorize.

Operational security focuses on the private or secret component. It should be generated with approved randomness, protected in hardware or an appropriate custody system, backed up according to recovery policy, and never exposed in logs or application code. Rotation may require an on-chain transaction and can be impossible for addresses permanently derived from one public key. Teams should test replacement and disaster-recovery procedures before the key becomes critical.

Payment systems should record key fingerprints or public identifiers without storing unnecessary secrets. They must distinguish account keys from API keys, encryption keys, and customer passwords. A successful Signature Verification proves that a matching key signed specific bytes, but not that the key was used by the intended human or under an approved workflow. Strong key management therefore includes access control, approval policy, monitoring, and revocation where the protocol permits it.