---
name: "nix3-key-generate-secret"
section: "1"
platform: "linux"
package: "nix-bin"
version: "2.26.3+dfsg-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/nix3-key-generate-secret"
---

# nix3-key-generate-secret(1)

generate a secret key for signing store paths

**Warning** \
 This program is **experimental** ⟨@docroot@/development/experimental-features.md#xp-feature-nix-command⟩ and its interface is subject to change.

## Name

`nix key generate-secret` - generate a secret key for signing store paths

## Synopsis

`nix key generate-secret` \[*option*…\]

## Examples

- •

  Generate a new secret key:

```
# nix key generate-secret --key-name cache.example.org-1 > ./secret-key
```

-

  We can then use this key to sign the closure of the Hello package:

```
# nix build nixpkgs#hello
# nix store sign --key-file ./secret-key --recursive ./result
```

-

  Finally, we can verify the store paths using the corresponding public key:

```
# nix store verify --trusted-public-keys $(nix key convert-secret-to-public < ./secret-key) ./result
```

## Description

This command generates a new Ed25519 secret key for signing store paths and prints it on standard output. Use `nix key` `convert-secret-to-public` to get the corresponding public key for verifying signed store paths.

The mandatory argument `--key-name` specifies a key name (such as `cache.example.org-1`). It is used to look up keys on the client when it verifies signatures. It can be anything, but it’s suggested to use the host name of your cache (e.g.  `cache.example.org`) with a suffix denoting the number of the key (to be incremented every time you need to revoke a key).

## Format

Both secret and public keys are represented as the key name followed by a base-64 encoding of the Ed25519 key data, e.g.

```
cache.example.org-0:E7lAO+MsPwTFfPXsdPtW8GKui/5ho4KQHVcAGnX+Tti1V4dUxoVoqLyWJ4YESuZJwQ67GVIksDt47og+tPVUZw==
```

## Options

- •

  `--key-name` ⟨#opt-key-name⟩ *name*

-

  Identifier of the key (e.g. `cache.example.org-1`).

### Logging-related options

- •

  `--debug` ⟨#opt-debug⟩

-

  Set the logging verbosity level to ‘debug’.

- •

  `--log-format` ⟨#opt-log-format⟩ *format*

-

  Set the format of log output; one of `raw`, `internal-json`, `bar` or `bar-with-logs`.

- •

  `--print-build-logs` ⟨#opt-print-build-logs⟩ / `-L`

-

  Print full build logs on standard error.

- •

  `--quiet` ⟨#opt-quiet⟩

-

  Decrease the logging verbosity level.

- •

  `--verbose` ⟨#opt-verbose⟩ / `-v`

-

  Increase the logging verbosity level.

### Miscellaneous global options

- •

  `--help` ⟨#opt-help⟩

-

  Show usage information.

- •

  `--offline` ⟨#opt-offline⟩

-

  Disable substituters and consider all previously downloaded files up-to-date.

- •

  `--option` ⟨#opt-option⟩ *name* *value*

-

  Set the Nix configuration setting *name* to *value* (overriding `nix.conf`).

- •

  `--refresh` ⟨#opt-refresh⟩

-

  Consider all previously downloaded files out-of-date.

- •

  `--version` ⟨#opt-version⟩

-

  Show version information.

  **Note**

  See `man nix.conf` ⟨@docroot@/command-ref/conf-file.md#command-line-flags⟩ for overriding configuration settings with command line flags.