Authentication Methods ChainStream CLI supports multiple authentication methods. Choose based on your use case:
Method Command Use Case DeFi Support API Key config set --key apiKey --value <key>Read-only data queries No Wallet Login loginFull access including DeFi Yes Email OTP login user@example.comAccount recovery, new device Yes Raw Private Key wallet set-raw --chain baseDev/testing only Yes
DeFi operations (swap, create token) require a wallet. API Key alone is not sufficient for signing transactions.
API Key (Recommended for Data) The simplest way to authenticate — works with any agent wallet setup:
chainstream config set --key apiKey --value < your_api_ke y >
Get an API Key from:
Verify your configuration:
chainstream config get # → apiKey: cs_live_****... # → walletMode: none
Wallet Login (Recommended for DeFi) Creates a non-custodial wallet with remote signing via a TEE (Trusted Execution Environment). A P-256 device key pair is stored locally for session authentication; the wallet’s signing keys remain in the TEE.
First-time Login This generates a P-256 device key pair stored in ~/.config/chainstream/keys/ and registers it with the ChainStream auth service. A wallet is created automatically — no email required.
Returning User Re-authenticates using your existing device key. No OTP needed.
With Email (Optional) # Login with email OTP chainstream login user@example.com # Complete verification chainstream verify --otp-id < i d > --code < cod e > --email user@example.com
Bind Email for Recovery chainstream bind-email user@example.com chainstream bind-email-verify --otp-id < i d > --code < cod e > --email user@example.com
Logout Clears the session from config but preserves your device keys in ~/.config/chainstream/keys/.
Raw Private Key (Dev Only) This stores your private key in plaintext in the config file. Only use for development and testing.
# Import EVM private key (Base) chainstream wallet set-raw --chain base # Import Solana private key chainstream wallet set-raw --chain sol
You will be prompted to enter the private key interactively.
Configuration All CLI configuration is stored in ~/.config/chainstream/config.json:
Setting Command Description API Key config set --key apiKey --value <key>ChainStream API Key Base URL config set --key baseUrl --value <url>API endpoint (default: https://api.chainstream.io) Wallet Chain config set --key walletChain --value <chain>Default chain for wallet operations
View Configuration # Show all settings (API Key is masked) chainstream config get # Show specific setting chainstream config get --key apiKey # Show auth status chainstream config auth # → Auth: TEE Wallet (org: ...) # → or: Auth: Raw Key (sol) # → or: Auth: API Key (cs_live_...) # → or: Auth: Not configured
Authentication Priority When multiple credentials are configured, the CLI uses this priority:
API Key — if apiKey is set in config, used directlyWallet — if a TEE wallet or raw key is configured, used for signing
Environment Variables Variable Default Description CHAINSTREAM_API_URLhttps://api.chainstream.ioAPI base URL CHAINSTREAM_AUTH_URLhttps://api.chainstream.ioAuth service URL SOLANA_RPC_URLhttps://api.mainnet-beta.solana.comSolana RPC endpoint BASE_RPC_URLhttps://mainnet.base.orgBase RPC endpoint CHAINSTREAM_DEBUG(unset) Enable debug output on errors
Next Steps
Command Reference Explore all available commands
x402 Payment Auto-purchase subscriptions with USDC
