---
title: Production best practices
description:
  Operate Keychain signing backends safely in production — separation of duties,
  key rotation, least-privilege access, availability, transport security,
  monitoring, and audit.
related:
  - /docs/tools/keychain/choosing-a-backend
  - /docs/payments/production-readiness
---

Keychain abstracts the signing backend, but operating a signer in production is
still your responsibility. These practices apply across backends; see
[Choosing a backend](/docs/tools/keychain/choosing-a-backend) for selecting one.

## Separate hot and cold signers

Use a low-balance operational ("hot") signer for frequent, automated
transactions, and a separate high-value ("cold") signer for treasury movements.
Back the cold signer with MPC custody or a cloud HSM and require approval
policies before it signs. Because the interface is identical, each role can use
a different backend without changing call sites.

## Rotate keys deliberately

On Solana the signing key _is_ the account address, so rotating a key produces a
new address. Plan rotation as a migration: provision a new key, reassign the
relevant authorities (or move funds) to the new address, then retire the old
one. Use distinct keys per environment so devnet keys are never reused on
mainnet.

## Grant least-privilege access

Scope each backend's credentials to the minimum needed to sign. For AWS KMS,
that is `kms:Sign` and `kms:DescribeKey` on the specific key; prefer IAM roles
over static credentials. Apply the same principle to Vault policies and managed
wallet API keys.

## Plan for availability

Remote backends depend on a network service. Call `isAvailable()` before relying
on a signer, apply retries with backoff on transient failures, and define a
fallback path for outages. Keychain enforces HTTPS for remote backends and
applies a default request timeout.

## Protect secrets and transport

- All remote backends communicate over HTTPS; non-HTTPS endpoints are rejected.
- Supply API keys, tokens, and credentials from a secret manager or environment
  variables — never hard-code them or commit them to source control.
- Keychain sanitizes error responses to avoid leaking secrets into logs; keep
  your own logging free of raw credentials and key material.

## Monitor and audit signing

Track signing success rate, latency, and failure counts, and alert on spikes —
see the metrics in
[Production Readiness](/docs/payments/production-readiness#monitoring). Enable
provider-side audit logs (KMS, Vault, or custodian) and reconcile them against
the transactions your application submits.