AgentaOS splits every private key into 3 shares. No single share can sign anything alone. The full key never exists — not in memory, not on disk, not ever.This guide gets you from install to signed transaction in 5 minutes.
This gives you both the agentaos and agenta commands. All examples below use agenta.
2
Login to your account
Copy
agenta login
Authenticate with your email and OTP.
3
Create your first signer
A signer is an identity — its own Ethereum address, its own key shares, its own policy constraints.
CLI
Dashboard
Copy
agenta init
The interactive wizard walks you through setup. Choose Create a new signer, pick a name and network. The CLI runs DKG, stores the signer share locally, and sends the server share to Vault.Verify it worked:
The CLI loads the local signer share, runs an interactive signing session with the server, and broadcasts the transaction. Two shares co-sign. The full key never appears.
Copy
import { Agenta } from '@agentaos/sdk';import { createWalletClient, http, parseEther } from 'viem';import { baseSepolia } from 'viem/chains';// Connect using API credentials (from agenta init or the dashboard)const agent = await Agenta.connect({ apiSecret: process.env.AGENTA_API_SECRET!, serverUrl: process.env.AGENTA_SERVER!, // e.g. https://api.agentaos.ai apiKey: process.env.AGENTA_API_KEY!,});// Create a viem wallet clientconst client = createWalletClient({ account: agent.toViemAccount(), chain: baseSepolia, transport: http(),});// Send — signing happens via distributed MPCconst hash = await client.sendTransaction({ to: '0xRecipient', value: parseEther('0.01'),});console.log('Transaction:', hash);// Clean up — wipes share from memoryagent.destroy();
Key setup created 3 key shares. No single share is the private key. Here’s where they live:
Share
Held by
Purpose
Signer share
Your machine (config file)
Autonomous agent signing
Server share
Vault (encrypted at rest)
Co-signs with signer or user
User share
Encrypted with your passkey
Emergency override from dashboard
No single share is a key. No two shares combined reconstruct a key. Signing is a multi-round protocol — two shares cooperate to produce a valid signature, and the private key never materializes.Signing used the Signer + Server path. Your CLI held one share, the server held another. They ran an interactive protocol over HTTPS. The result: a standard Ethereum transaction, signed and broadcast, with no full key anywhere in the process.
