Key Use
Request identity and derived public keys with BRC-100 WalletClient, preserve derivation context and keep private keys under wallet custody.
Use the BRC-100 wallet to request public keys and cryptographic operations, never private-key exports. These examples were checked against @bsv/sdk 4.0.0 on October 26, 2026. A wallet can bundle a different SDK; the Metanet integration guide documents Client 0.8.11's separate baseline.
Identity and derived keys
An identity key is a compressed public key used to identify a wallet/profile. It is not a traditional BSV address or recovery secret. A protocol/key-ID pair selects a derived key for an application's task. Use stable identifiers and the same intended counterparty when later signing, verifying, encrypting or decrypting.
Install @bsv/sdk@4.0.0 using a maintained, patched Node.js 22 or 24 release. Run the app with Client unlocked on desktop or inside Explorer on mobile.
1import { PublicKey, WalletClient } from '@bsv/sdk'
2
3const wallet = new WalletClient('auto')
4await wallet.waitForAuthentication()
5
6const { publicKey: identityKey } = await wallet.getPublicKey({ identityKey: true })
7console.log('Connected identity key:', identityKey)
8
9const { publicKey: ownAppKey } = await wallet.getPublicKey({
10 protocolID: [1, 'example app keys'],
11 keyID: 'session-1',
12 counterparty: 'self',
13 forSelf: true
14})
15console.log('My derived public key:', ownAppKey)
16
17// Call only after obtaining the intended peer's complete identity key.
18async function getPeerAppKey(peerIdentityKey: string) {
19 PublicKey.fromString(peerIdentityKey) // validate the supplied compressed key
20 return wallet.getPublicKey({
21 protocolID: [1, 'example app keys'],
22 keyID: 'session-1',
23 counterparty: peerIdentityKey,
24 forSelf: false
25 })
26}The expected result is public-key data, subject to wallet authentication and permission. These calls do not create a payment. The peer example derives a counterparty key for this relationship/protocol; it is not a general-purpose lookup of someone else's wallet or private keys. Changing the local wallet/profile, protocol, key ID, counterparty or forSelf selection can change the returned key.
Choose the right request
| Task | BRC-100 operation |
|---|---|
| Identify the connected wallet/profile | getPublicKey({ identityKey: true }) |
| Request a protocol-specific public key | getPublicKey with protocol ID, key ID and intended counterparty |
| Sign or verify bytes | createSignature / verifySignature with a complete argument object |
| Encrypt or decrypt bytes | encrypt / decrypt with matching derivation parameters |
| Prove selected certificate fields | proveCertificate with the required certificate, field and verifier arguments |
Do not use old positional examples such as verifySignature(data, signature, publicKey), or omit the protocol/key-ID fields from an encryption request. The wallet interface takes structured arguments. Follow signing, encryption and the published wallet API reference.
Private-key custody depends on the wallet implementation. The BRC-100 application interface does not expose those keys to your page. Never ask a person to paste a recovery key or seed into your app, and never treat public-key access as permission to spend. Handle a denied request as an ordinary outcome.
The maintained SDK source is ts-stack/packages/sdk. Keep the complete derivation context with app data that needs to be recovered later; a public identity key alone is not a backup.