---
title: How to Sign with a Keychain Backend
description:
  "Sign Solana transactions through a key-management backend using
  @solana/keychain, so you can swap signing providers without changing code."
---

[Keychain](/docs/tools/keychain) provides one `SolanaSigner` interface across
many key-management backends — in-memory keys, cloud KMS/HSM, and managed wallet
services. Write your signing code once, then switch backends through
configuration.

The example below signs and sends a transfer with an in-memory signer. The same
code works with any backend; only the signer's construction changes.

<CodeTabs storage="cookbook" flags="r">

```ts !! title="Kit" file=packages/docs-examples/cookbook/wallets/sign-with-keychain/kit.ts#region=sign

```

</CodeTabs>

<Callout type="warn">
  The in-memory signer holds a raw private key — use it for development and
  tests. In production, use a managed backend so keys stay in dedicated
  infrastructure. See [Choosing a
  backend](/docs/tools/keychain/choosing-a-backend).
</Callout>

## Use a production backend

To sign with a production backend, install its package (or the umbrella
`@solana/keychain`) and construct the signer through the unified factory. The
signing code stays the same.

```ts title="AWS KMS"
import { createKeychainSigner } from "@solana/keychain";

const signer = await createKeychainSigner({
  backend: "aws-kms",
  keyId: "alias/my-solana-key",
  publicKey: "base58_public_key"
});
```

```ts title="HashiCorp Vault"
import { createKeychainSigner } from "@solana/keychain";

const signer = await createKeychainSigner({
  backend: "vault",
  vaultAddr: "https://vault.example.com:8200",
  vaultToken: "hvs.xxxxx",
  keyName: "my-solana-key",
  publicKey: "base58_public_key"
});
```

See the [TypeScript guide](/docs/tools/keychain/getting-started/typescript) for
every backend's configuration, or
[Choosing a backend](/docs/tools/keychain/choosing-a-backend) to compare custody
models.