clef

Start clef with default settings

$ clef

$ clef init

$ clef --chainid [1]

$ clef --keystore [path/to/keystore]

$ clef --list

$ clef --rules [path/to/rules.js]

$ clef --stdio-ui

clef [options] [command]

Clef is a standalone Ethereum account management and signing tool from the go-ethereum project. It provides secure storage of private keys and transaction signing capabilities separate from the main Ethereum client.
Clef acts as a signing oracle that can approve or reject transaction signing requests. It supports hardware wallets, encrypted keystores, and can run in a detached mode where a JavaScript rules engine automatically processes signing requests based on predefined policies.
The tool is designed for enhanced security by isolating key management from network-facing components. It can serve multiple clients through IPC or HTTP interfaces, making it suitable for both individual use and as part of larger infrastructure deployments.

init

Initialize the signer, generating a master seed and creating necessary directories.

Directory for the keystore containing encrypted account keys.

Chain ID for transaction signing (1=mainnet, 11155111=sepolia).

Path to JavaScript rules file for automatic transaction approval.

Use standard input/output for user interface (for integration with external tools).

Path for the IPC endpoint.

Enable HTTP-RPC server for remote signing requests.

HTTP server listening address (default: localhost).

HTTP server listening port (default: 8550).

List all accounts in the keystore.

Display help information.

Clef requires careful backup of the master seed created during initialization. Lost seeds cannot be recovered. The HTTP interface should only be enabled with proper firewall rules in production environments. Rules-based automatic signing requires thorough security auditing.

Clef was introduced by the go-ethereum (Geth) team in 2018 as part of an effort to improve Ethereum account security. It was designed to replace the integrated account management in Geth with a more secure, standalone signing solution that reduces attack surface.

geth(1), ethkey(1)