NKeys

With NKeys the server can verify identities without ever storing or ever seeing private keys. The authentication system works by requiring a connecting client to provide its public key and digitally sign a challenge with its private key. The server generates a random challenge with every connection request, making it immune to playback attacks. The generated signature is validated against the provided public key, thus proving the identity of the client. If the public key is known to the server, authentication succeeds.

To generate nkeys, you’ll need the tool.

Example output

The first output line starts with the letter S for Seed. The second letter, stands for User. Seeds are private keys; you should treat them as secrets and guard them with care.

The second line starts with the letter U for User and is a public key which can be safely shared.

Note that the user section sets the nkey property (user/password/token properties are not needed). Add sections as required.

Client Configuration

Now that you have a user nkey, let’s configure a client to use it for authentication. As an example, here are the connect options for the node client:

The client provides a function that it uses to parse the seed (the private key) and sign the connection challenge.