$npx -y skills add aptos-labs/aptos-agent-skills --skill ts-sdk-accountHow to create and use Account (signer) in @aptos-labs/ts-sdk. Covers Account.generate(), fromPrivateKey(), fromDerivationPath(), Ed25519 vs SingleKey vs MultiKey vs Keyless, serialization (fromHex/toHex). Triggers on: 'Account.generate', 'Account.fromPrivateKey', 'Ed25519PrivateK
| 1 | # TypeScript SDK: Account (Signer) |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | Guide creation and use of **Account** (signer) in `@aptos-labs/ts-sdk`. An Account holds address + key material and can |
| 6 | sign transactions and messages. **Creating an Account does NOT create the account on-chain**; use faucet or transfer to |
| 7 | fund it. |
| 8 | |
| 9 | ## ALWAYS |
| 10 | |
| 11 | 1. **Use `Account.generate()` or `Account.fromPrivateKey()` only in server/script** – never in frontend; use wallet |
| 12 | adapter for end users. |
| 13 | 2. **Load private keys from env (e.g. `process.env.PRIVATE_KEY`) on server** – never hardcode. |
| 14 | 3. **Use `account.accountAddress` when building transactions** – pass as sender/secondary signers. |
| 15 | 4. **Use `aptos.signAndSubmitTransaction({ signer: account, transaction })`** with the same Account instance that holds |
| 16 | the key. |
| 17 | |
| 18 | ## NEVER |
| 19 | |
| 20 | 1. **Do not use `Account.generate()` or raw private keys in browser/frontend** – use wallet adapter. |
| 21 | 2. **Do not hardcode private keys** in source or commit to git. |
| 22 | 3. **Do not confuse `Account` (API namespace) with `Account` (signer class)** – API is `aptos.account.*`; signer is the |
| 23 | class from `Account` module (e.g. `Account.fromPrivateKey`). |
| 24 | |
| 25 | --- |
| 26 | |
| 27 | ## Account types (signing schemes) |
| 28 | |
| 29 | | Type | Class | Use case | |
| 30 | | ----------------- | ------------------------- | ---------------------------------- | |
| 31 | | Ed25519 (legacy) | `Ed25519Account` | Single Ed25519 key, legacy auth | |
| 32 | | SingleKey | `SingleKeyAccount` | Ed25519 or Secp256k1, unified auth | |
| 33 | | MultiKey | `MultiKeyAccount` | Multi-sig | |
| 34 | | Keyless | `KeylessAccount` | Keyless (e.g. OIDC) | |
| 35 | | Federated Keyless | `FederatedKeylessAccount` | Federated keyless | |
| 36 | |
| 37 | --- |
| 38 | |
| 39 | ## Generate new account (server/script only) |
| 40 | |
| 41 | ```typescript |
| 42 | import { Account, SigningSchemeInput } from "@aptos-labs/ts-sdk"; |
| 43 | |
| 44 | // Default: Ed25519 legacy |
| 45 | const ed25519Account = Account.generate(); |
| 46 | |
| 47 | // SingleKey (unified) with Ed25519 |
| 48 | const singleKeyAccount = Account.generate({ scheme: SigningSchemeInput.Ed25519, legacy: false }); |
| 49 | |
| 50 | // SingleKey with Secp256k1 |
| 51 | const secpAccount = Account.generate({ scheme: SigningSchemeInput.Secp256k1 }); |
| 52 | |
| 53 | // Access address and public key |
| 54 | const address = ed25519Account.accountAddress; |
| 55 | const pubKey = ed25519Account.publicKey; |
| 56 | ``` |
| 57 | |
| 58 | --- |
| 59 | |
| 60 | ## From private key |
| 61 | |
| 62 | ```typescript |
| 63 | import { Account, Ed25519PrivateKey, Secp256k1PrivateKey } from "@aptos-labs/ts-sdk"; |
| 64 | |
| 65 | // Ed25519 legacy (default) |
| 66 | const privateKeyHex = process.env.PRIVATE_KEY!; // e.g. "0x..." or AIP-80 prefixed |
| 67 | const privateKey = new Ed25519PrivateKey(privateKeyHex); |
| 68 | const account = Account.fromPrivateKey({ privateKey }); |
| 69 | |
| 70 | // Ed25519 SingleKey (unified) |
| 71 | const accountSingle = Account.fromPrivateKey({ |
| 72 | privateKey: new Ed25519PrivateKey(privateKeyHex), |
| 73 | legacy: false |
| 74 | }); |
| 75 | |
| 76 | // Secp256k1 (always SingleKey) |
| 77 | const secpKey = new Secp256k1PrivateKey(process.env.SECP_KEY!); |
| 78 | const accountSecp = Account.fromPrivateKey({ privateKey: secpKey }); |
| 79 | |
| 80 | // Optional: fixed address (e.g. after key rotation) |
| 81 | const accountWithAddr = Account.fromPrivateKey({ |
| 82 | privateKey, |
| 83 | address: "0x..." |
| 84 | }); |
| 85 | ``` |
| 86 | |
| 87 | --- |
| 88 | |
| 89 | ## From mnemonic (derivation path) |
| 90 | |
| 91 | ```typescript |
| 92 | import { Account } from "@aptos-labs/ts-sdk"; |
| 93 | |
| 94 | const mnemonic = "word1 word2 ... word12"; |
| 95 | const path = "m/44'/637'/0'/0'/0'"; // Aptos BIP-44 path |
| 96 | |
| 97 | // Ed25519 legacy |
| 98 | const acc = Account.fromDerivationPath({ mnemonic, path }); |
| 99 | |
| 100 | // Ed25519 SingleKey |
| 101 | const accSingle = Account.fromDerivationPath({ mnemonic, path, legacy: false }); |
| 102 | |
| 103 | // Secp256k1 |
| 104 | const accSecp = Account.fromDerivationPath({ |
| 105 | scheme: SigningSchemeInput.Secp256k1, |
| 106 | mnemonic, |
| 107 | path |
| 108 | }); |
| 109 | ``` |
| 110 | |
| 111 | --- |
| 112 | |
| 113 | ## Auth key (for rotation / lookup) |
| 114 | |
| 115 | ```typescript |
| 116 | const authKey = Account.authKey({ publicKey: account.publicKey }); |
| 117 | // Use authKey.derivedAddress() for address derivation; useful for multi-account lookup |
| 118 | ``` |
| 119 | |
| 120 | --- |
| 121 | |
| 122 | ## Serialization (toHex / fromHex) |
| 123 | |
| 124 | Use when persisting or sending account (e.g. server-only, never expose private key to frontend): |
| 125 | |
| 126 | ```typescript |
| 127 | import { Account, AccountUtils } from "@aptos-labs/ts-sdk"; |
| 128 | |
| 129 | const account = Account.generate(); |
| 130 | |
| 131 | // Serialize to hex (includes private key – treat as secret) |
| 132 | const hex = AccountUtils.toHexString(account); |
| 133 | |
| 134 | // Deserialize back |
| 135 | const restored = AccountUtils.fromHex(hex); |
| 136 | |
| 137 | // Typed deserialize |
| 138 | const edAccount = AccountUtils.ed25519AccountFromHex(hex); |
| 139 | const si |