---
title: "Sign in to ERPC CLI and see where your keys are kept"
description: "Sign this machine in to your ERPC account, choose where ERPC CLI keeps the session, and see where node keys and the files erpc writes are kept."
canonical: "https://erpc.global/en/doc/erpc-cli/sign-in-and-keys/"
locale: "en"
---

# Sign in to ERPC CLI and see where your keys are kept

Sign this machine in, and ERPC CLI keeps the session in your keychain or 1Password. This page also shows where node keys are kept and which files erpc keeps.

This page describes ERPC CLI `v0.1.0-rc.4`, a pre-release.

## Sign in

```bash
erpc signup     # opens the sign-up page
erpc login      # signs this machine in; the session goes to the keychain or 1Password
erpc whoami
```

`erpc login` gets the session through the OAuth device authorization grant. On a machine without a browser, `erpc login --no-browser` prints the URL and code instead of opening one, and `erpc signup --no-browser` prints the sign-up URL. `erpc whoami` shows who the stored session belongs to, and `erpc logout` signs out and removes the stored session.

## Choose where the session is kept

At a terminal, `erpc login` asks which store to use: the operating system's keychain, which is the default, or 1Password when it answers. `--store` and `--vault` choose without asking, and the choice is recorded in `config.toml`, where the other commands read it.

| `--store` | Where the session is kept |
| --- | --- |
| `keychain` | The operating system's keychain |
| `1password-desktop` (also `1password`, `op`) | 1Password, through the desktop application |
| `1password-service-account` | 1Password, through a service account token |
| `file` | A file on disk. This leaves a secret on this machine |

Without a choice, given or recorded, erpc uses a 1Password service account when `OP_SERVICE_ACCOUNT_TOKEN` is set, else the operating system's keychain when there is one, else a file in its state directory. `erpc doctor` reports which store is in use and why. With a service account, erpc passes `OP_SERVICE_ACCOUNT_TOKEN` only to the `op` processes it starts, and does not write that token anywhere.

The 1Password item is titled with the machine's name, so that two machines never share one session. `ERPC_HOST_LABEL` overrides the name.

### On Linux

The keychain is the Secret Service where one answers. Otherwise it is the kernel's persistent keyring for your user, which is in memory and never on disk: the session lasts until a reboot or a few days unused, and then `erpc login` is asked for again. A shell started without a login of its own (`su` without `-`, `sudo -E`) cannot use that keyring, and erpc refuses and says so.

### On macOS

erpc reaches the keychain through `/usr/bin/security`. Any other program running as you can read the session by running `security` too, while the keychain still keeps the session encrypted at rest and away from other users.

### When the session is on disk

erpc writes the session to its state directory in three cases: with the `file` store, for a parked session (a rotated refresh token that could not reach the store), and after an interrupted write. `erpc doctor` reports each such file for as long as it exists. On Unix these files are created with mode `0600`; on Windows erpc sets no permissions of its own.

## Where node keys are kept

The node inventory, and the original-key backups each chain's guide names, are kept in 1Password. Not every key is in 1Password, and a node may hold a key it needs to run. Back up what is on a host yourself: rebuilding that host without a backup loses it. An active Sui validator or an elected TRON witness also refuses to move to a new host.

| Node | In 1Password | On the host |
| --- | --- | --- |
| Solana validator (native) | The identity and the sync keypair you made. The vote account and withdraw authority are given to erpc as public keys only | The sync keypair, encrypted to that host, and from `--activate-validator` on the identity too. The vote account and withdrawal keys are never imported |
| Solana validator (solv) | Staked identity, and the withdraw authority unless you give only its public key. The vote account key is deleted once the account is verified | A throwaway `unstaked-identity.json` in plain text. A deploy never copies the staked key or the withdraw authority to the node |
| Solana RPC (native) | The identity you made | The same identity, encrypted to that host |
| Solana RPC (solv) | The inventory | The identity, made there. It never leaves |
| Ethereum validator | The inventory | Keystores, their unlock password and the slashing history. A backup's history stops at its snapshot, so restoring a key that signed after it can be slashed: move a signer with `erpc v --chain eth migrate` |
| Arc RPC | The consensus key | The consensus key, encrypted |
| Avalanche | A backup of the staking and BLS keys | The same keys, made there on the first deploy |
| Sui validator | The protocol, network and worker keys, made on your own machine | The same three keys, encrypted with `systemd-creds` to that host. Never the account key |
| Sui full node | The inventory | The network credential, encrypted to that host. There is no other copy |
| TRON witness | The encrypted keystore and its password | The same, as encrypted systemd credentials |
| Polygon validator | The signer key `init` generates. The staking owner's key is never asked for | The same key, encrypted to that host. While it only observes, the node runs under a separate identity |
| BNB Chain validator | A backup of the signing material and the peer identity | The consensus key in an encrypted keystore, the vote key in an encrypted wallet, and their passwords encrypted to that host |
| Kaia validator (consensus or proxy node) | A backup of the node identity | The node identity, made on the host and encrypted to it. The operator's wallets stay outside erpc |
| Monad node (RPC or validator) | Both original keystores | The same keystores, encrypted to that host |
| Hyperliquid validator | The hot consensus key. The cold account's key is never asked for | The hot key, encrypted to that host and loaded only by activated validator units |
| Hyperliquid AQA publisher | Its dedicated API or agent key | The same key, encrypted to that host |
| NEAR validator | The consensus key | The same key, encrypted to that host |
| Arbitrum validator | The wallet `init` generates, and the provider credential | The provider credential, encrypted, and from `--activate-signer` on the wallet too, root-owned and encrypted |
| Robinhood Chain validator | The wallet `init` generates, and the provider configuration | The provider configuration, encrypted, and from `--activate-signer` on the wallet too, root-owned and encrypted |
| OP-family RPC | The inventory and provider values | Provider credential, engine JWT and peer identities, encrypted. Back up the owner record and the host's encryption secret |
| Nitro RPC | The inventory and upstream credential | The upstream credential, encrypted |

Other RPC nodes hold no signing key for a validator, but their hosts keep what the client makes for itself, such as an engine JWT, a peer identity or an RPC cookie.

A key backup alone does not make validator recovery safe. Follow the chain's recovery procedure before you replace a server or restore its data; each chain's guide says how to restore its keys ([Nodes](https://erpc.global/en/doc/erpc-cli/nodes/#chains-and-guides)).

One command writes node keys to disk on your machine: `erpc validator vote-account` writes the identity and vote keys to `0600` files under the state directory while the Solana CLI runs, and wipes them afterwards. A process that dies can leave a file until a later run sweeps it.

An `erpc worker` app's trading key and secrets are kept apart from these: [Keys and secrets](https://erpc.global/en/doc/erpc-cli/worker-secrets/).

## Files erpc keeps

| Path | What it holds |
| --- | --- |
| `~/.erpc/config.toml` | Public settings (`erpc config`) |
| `~/.erpc/state/` | The session and locks (`erpc doctor` says how the session is stored) |
| `~/.erpc/conversations/` | Saved ERPC AI conversations |
| `~/.erpc/memory.json` | What ERPC AI remembers |
| `~/.erpc/vps_hosts.json` | Host keys of VPSs ERPC AI logged in to |
| `~/.erpc/skills/` | Skills written by `erpc skills install` |
| `~/.erpc/storage-key` | The storage encryption key, when `erpc login` keeps the session in a file |
| `~/.erpc/backup-password`, `~/.erpc/backup-admin-key` | The backup master password and `read_write` key, when `erpc login` keeps the session in a file |
| `~/.erpc/keystore/` | The worker keystore: an app's secrets and trading key, each in a file encrypted under your passphrase, on a machine with neither 1Password nor a keychain that lasts |
| `~/.erpc/workers.toml` | The list of `erpc worker` apps on this machine |
| `~/.erpc/backup.env` | This machine's backup credentials (`0600`) |
| `~/.erpc/bin/restic-0.19.1` | The pinned restic `erpc backup` installs |