# Key Use

Canonical: https://docs.projectbabbage.com/docs/guides/wallet/key-use

Request identity and derived public keys with BRC-100 WalletClient, preserve derivation context and keep private keys under wallet custody.

Use the BRC-100 wallet to request **public keys and cryptographic operations**, never private-key exports. These examples were checked against **`@bsv/sdk` 4.0.0 on October 26, 2026**. A wallet can bundle a different SDK; the [Metanet integration guide](https://docs.projectbabbage.com/docs/metanet-client/developers) documents Client 0.8.11's separate baseline.

## Identity and derived keys

An identity key is a compressed public key used to identify a wallet/profile. It is not a traditional BSV address or recovery secret. A protocol/key-ID pair selects a derived key for an application's task. Use stable identifiers and the same intended counterparty when later signing, verifying, encrypting or decrypting.

Install `@bsv/sdk@4.0.0` using a maintained, patched Node.js 22 or 24 release. Run the app with Client unlocked on desktop or inside Explorer on mobile.

```ts
import { PublicKey, WalletClient } from '@bsv/sdk'

const wallet = new WalletClient('auto')
await wallet.waitForAuthentication()

const { publicKey: identityKey } = await wallet.getPublicKey({ identityKey: true })
console.log('Connected identity key:', identityKey)

const { publicKey: ownAppKey } = await wallet.getPublicKey({
  protocolID: [1, 'example app keys'],
  keyID: 'session-1',
  counterparty: 'self',
  forSelf: true
})
console.log('My derived public key:', ownAppKey)

// Call only after obtaining the intended peer's complete identity key.
async function getPeerAppKey(peerIdentityKey: string) {
  PublicKey.fromString(peerIdentityKey) // validate the supplied compressed key
  return wallet.getPublicKey({
    protocolID: [1, 'example app keys'],
    keyID: 'session-1',
    counterparty: peerIdentityKey,
    forSelf: false
  })
}
```

The expected result is public-key data, subject to wallet authentication and permission. These calls do not create a payment. The peer example derives a counterparty key for this relationship/protocol; it is not a general-purpose lookup of someone else's wallet or private keys. Changing the local wallet/profile, protocol, key ID, counterparty or `forSelf` selection can change the returned key.

## Choose the right request

| Task | BRC-100 operation |
| --- | --- |
| Identify the connected wallet/profile | `getPublicKey({ identityKey: true })` |
| Request a protocol-specific public key | `getPublicKey` with protocol ID, key ID and intended counterparty |
| Sign or verify bytes | `createSignature` / `verifySignature` with a complete argument object |
| Encrypt or decrypt bytes | `encrypt` / `decrypt` with matching derivation parameters |
| Prove selected certificate fields | `proveCertificate` with the required certificate, field and verifier arguments |

Do not use old positional examples such as `verifySignature(data, signature, publicKey)`, or omit the protocol/key-ID fields from an encryption request. The wallet interface takes structured arguments. Follow [signing](https://docs.projectbabbage.com/docs/guides/wallet/signing), [encryption](https://docs.projectbabbage.com/docs/guides/wallet/encryption) and the [published wallet API reference](https://bsv-blockchain.github.io/ts-sdk/reference/wallet/).

Private-key custody depends on the wallet implementation. The BRC-100 application interface does not expose those keys to your page. Never ask a person to paste a recovery key or seed into your app, and never treat public-key access as permission to spend. Handle a denied request as an ordinary outcome.

The maintained SDK source is [ts-stack/packages/sdk](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/sdk). Keep the complete derivation context with app data that needs to be recovered later; a public identity key alone is not a backup.