Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content

signer

The signing provider — the key material your relayers derive wallets from. Exact rrelayer signing_providers schema, all 9 providers. Optional: monitoring-only projects declare no signer and the relayer engine never boots.

Exactly one provider must be set (validation error otherwise).

signer:
  aws_kms:
    region: eu-west-1

The 9 providers

Field-level semantics are rrelayer's — see the rrelayer signing provider docs for provider setup guides.

raw — dev only

signer:
  raw:
    mnemonic: ${RAW_DANGEROUS_MNEMONIC}

A plain mnemonic. Fine for anvil and testnets; the env var name says the rest.

private_keys

signer:
  private_keys: [${PK_0}, ${PK_1}]

aws_kms

signer:
  aws_kms:
    region: eu-west-1
    # endpoint_url, multi_region, danger_override_alias — optional

aws_secret_manager

signer:
  aws_secret_manager: { id: my-secret, key: mnemonic, region: eu-west-1 }

gcp_secret_manager

signer:
  gcp_secret_manager:
    id: my-secret
    key: mnemonic
    service_account_key_path: ./gcp-sa.json
    # version — optional

privy

signer:
  privy: { app_id: ${PRIVY_APP_ID}, app_secret: ${PRIVY_APP_SECRET} }

turnkey

signer:
  turnkey:
    api_public_key: ${TURNKEY_PUB}
    api_private_key: ${TURNKEY_PRIV}
    organization_id: ${TURNKEY_ORG}
    wallet_id: ${TURNKEY_WALLET}

fireblocks

signer:
  fireblocks:
    api_key: ${FIREBLOCKS_API_KEY}
    private_key_path: ./fireblocks.pem
    identity: my-vault
    # sandbox, hidden_on_ui — optional

pkcs11 — hardware modules (beta)

signer:
  pkcs11:
    library_path: /usr/lib/softhsm/libsofthsm2.so
    identity: rflow
    # pin, slot_id, test_mode — optional

Per-network override

Any network can override the global signer — e.g. KMS on mainnet, a raw mnemonic on a testnet:

signer:
  aws_kms: { region: eu-west-1 }
 
networks:
  - name: ethereum
    chain_id: 1
    rpc: ${ETH_RPC}
  - name: sepolia
    chain_id: 11155111
    rpc: ${SEPOLIA_RPC}
    signing_provider:
      raw: { mnemonic: ${TEST_MNEMONIC} }

How keys map to relayers

One signing provider yields many wallets by wallet index (mnemonic index 0, 1, 2… / KMS key n). When rflow creates a relayer, rrelayer assigns the next free index and persists it — that index is the name↔key mapping. See the relayer lifecycle.