Generate Quantum keys and keep the boundary explicit.

Public data identifies the account. Secret data authorizes it.

Private key

Secret native key material. It is never an RPC parameter and never appears in a signed transaction.

Public key

The exact 1,952-byte key carried by signed transactions.

Address

Keccak-256(publicKey)[12:32], the low 20 bytes of the hash.

Signature

The exact 3,293-byte result returned for a 32-byte signing digest.

Display format

Addresses use the familiar 0x plus 40 hexadecimal character form. Public keys and signatures should stay binary inside applications.

Create a disposable wallet for Sandbox tests.

import { QuantumWallet, bytesToHex } from "@quantum_chain/sdk";

const wallet = QuantumWallet.generate();
try {
  console.log("address", wallet.address);
  console.log("public key", bytesToHex(wallet.publicKey));
} finally {
  wallet.destroy();
}

QuantumWallet.generate() creates a local native signer. publicKey is a defensive copy. destroy() erases local signer state where the native implementation supports it.

Use the signer as a context manager.

from py_quantum import Signer

with Signer.generate() as signer:
    print("address", signer.address_hex)
    print("public key bytes", len(signer.public_key))

The Python API intentionally does not expose private-key bytes. The native handle owns them until close(), which the context manager calls automatically.

Let transaction callers depend on an interface, not key storage.

interface QuantumSigner {
  getPublicKey(): Promise<Uint8Array>;
  signDigest(digest: Uint8Array): Promise<Uint8Array>;
}

An external signer receives the exact 32-byte digest only after the caller has validated network identity and complete transaction intent. It returns the public key and canonical signature. The transaction layer verifies both before attachment.

• Authorize client identity to a specific key.
• Bind every key to allowed network and chain ID tuples.
• Reject anonymous signing.
• Use authenticated, encrypted transport with deadlines.
• Audit request ID, key ID, network, chain ID, digest, result, and caller identity without logging private keys.
• Keep transaction formatting outside the key provider.

Use node keystores only for their intended operational profile.

./build/bin/keygenerator --passphrase "REPLACE_WITH_A_STRONG_PASSPHRASE"

./build/bin/keygenerator \
  --passphrase "REPLACE_WITH_A_STRONG_PASSPHRASE" \
  --recover "REPLACE_WITH_THE_COMPLETE_12_WORD_MNEMONIC"

The current command writes both an encrypted keystore and a separate mnemonic file in its working directory. Move the mnemonic immediately into the approved offline recovery process and remove the plaintext working copy through your organization’s secure procedure.

A Web3-style keystore protects the serialized private key with a password-based encryption envelope. Compatibility of the JSON container does not make generic Ethereum key tools Quantum-compatible. They may assume a different plaintext key type.

Protect the key before, during, and after signing.

• Never send a private key or mnemonic to RPC, a faucet, an explorer, a support ticket, or telemetry.
• Do not store private keys in source, environment variables, container images, or unencrypted artifacts.
• Use strict file permissions for development keystores and mnemonic recovery material.
• Validate a backup by recovering it in an isolated procedure before depending on it.
• Require network and transaction policy before releasing a signature.
• Destroy temporary secret copies and local signer handles as soon as possible.
• Use separate keys for Sandbox and Mainnet.