Skip to content
Merged
Show file tree
Hide file tree
Changes from 14 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
77b3f6f
introduce cbor debugging + move funding to get started
0xBora Aug 28, 2025
9993906
update conway era
0xBora Aug 28, 2025
3cdb2be
txId links + header hierarchy
0xBora Aug 28, 2025
57fec39
remove word
0xBora Aug 28, 2025
a86154a
update cardano-cli structure + governance pages
0xBora Aug 28, 2025
0efd974
Update links and references in governance and CLI documentation + sid…
0xBora Aug 28, 2025
32fe76b
cardano-cli prerequisite
0xBora Aug 28, 2025
2501266
update landing description
0xBora Aug 29, 2025
180fe2e
Update docs/smart-contracts/advanced/debug-cbor.md
0xBora Aug 29, 2025
59f75fe
Update docs/smart-contracts/advanced/debug-cbor.md
0xBora Aug 29, 2025
30ba837
Update docs/smart-contracts/advanced/debug-cbor.md
0xBora Aug 29, 2025
6a0aa61
add pycardano
0xBora Aug 29, 2025
676f7e6
add video format resources
0xBora Aug 29, 2025
f42c1b2
Merge branch 'staging' into docs/update-2
rphair Aug 30, 2025
06cfb7e
Add Aiken overview images and update documentation
0xBora Aug 31, 2025
7a7d309
introduce navbar dropdowns and seperate category sidebar visibility
0xBora Sep 4, 2025
af3859f
move security docs to Get Started section and add redirects
0xBora Sep 4, 2025
4bc73ef
Update sidebars.js (Security & Key Management autogeneration)
0xBora Sep 8, 2025
8b61e20
Merge branch 'staging' into docs/update-2
rphair Sep 8, 2025
a7c28ef
fix merge conflict with cardano-testnet.md on staging
0xBora Sep 8, 2025
5fedb62
fix links for security & key management
0xBora Sep 8, 2025
b8d36a3
resolve previous conflicts cardano-testnet
0xBora Sep 8, 2025
de09d63
add newline
0xBora Sep 8, 2025
b4d9dbb
Merge branch 'staging' into docs/update-2
0xBora Sep 8, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
id: get-started
title: Get started with Cardano CLI
sidebar_position: 1
sidebar_label: CLI - Get started
sidebar_label: Get started
keywords: [cardano-cli, cli, keys, addresses, cardano-node]
---

Expand All @@ -16,6 +16,10 @@ Cardano CLI uses the *node-to-client* protocol to communicate with the node. Thi
export CARDANO_NODE_SOCKET_PATH=~/node.socket
```

:::note
This guide assumes you have installed cardano-node into your system. If not you can refer to Installing [cardano-node](../../../operate-a-stake-pool/node-operations/installing-cardano-node) guide for instructions on how to do that.
:::

### CARDANO_NODE_NETWORK_ID

Each network has a unique identifier (--mainnet or --testnet-magic NATURAL). This is used by the node-to-client protocol to ensure communication with a node on the desired network. It is useful to set up an environment variable for the network ID. Alternatively, you can provide the flag `--testnet-magic <network-id>` with each command that interacts with the node.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ keywords: [cardano-cli, cli, keys, stake addresses, register, cardano-node, tran
---

:::tip
To integrate the latest (Conway) era, which differs significantly from previous eras, `cardano-cli` has introduced `<era>` as a top-level command, replacing the former `<era>` flags. For example, instead of using era-specific flags like `--babbage-era` with commands such as `cardano-cli transaction build --babbage-era`, users must now utilize the syntax `cardano-cli <era> transaction build <options>`.
To integrate the latest (Conway) era, which differs significantly from previous eras, `cardano-cli` has introduced `<era>` as a top-level command, replacing the former `<era>` flags. For example, instead of using era-specific flags like `--babbage-era` with commands such as `cardano-cli transaction build --babbage-era`, users must now utilize the syntax `cardano-cli <era> transaction build <options>`.
:::

## Registering a stake address
Expand Down Expand Up @@ -82,15 +82,17 @@ cardano-cli latest transaction build \
--certificate-file registration.cert \
--out-file tx.raw
```
:::note

:::note
With the `build` command, you don't need to worry about the transaction fees and deposit, it handles it automatically:
:::

Inspecting the `tx.raw` file reveals that this transaction includes the certificate, and is ready to be signed and submitted.
Inspecting the `tx.raw` file reveals that this transaction includes the certificate, and is ready to be signed and submitted.

```shell
cardano-cli debug transaction view --tx-file tx.raw
```

```json
{
"auxiliary scripts": null,
Expand Down Expand Up @@ -140,7 +142,7 @@ cardano-cli debug transaction view --tx-file tx.raw

### Using the `build-raw` command

Using the `build-raw` command involves a slightly more intricate process. Similarly to the steps outlined in [simple transactions](docs/get-started/cli-operations/basic-operations/simple-transactions.md), you should calculate the fee yourself, and handle the deposit accordingly.
Using the `build-raw` command involves a slightly more intricate process. Similarly to the steps outlined in [simple transactions](docs/get-started/cardano-cli/basic-operations/simple-transactions.md), you should calculate the fee yourself, and handle the deposit accordingly.

Query the balance of the `payment.addr`:

Expand Down Expand Up @@ -169,20 +171,23 @@ cardano-cli latest query utxo --address $(< paymentstake.addr) --output-json
}
}
```

Using `jq` to parse that JSON

```shell
cardano-cli latest query utxo --address $(< payment.addr) --output-json | jq -r .[].value.lovelace
9999834851
```

:::

Query the protocol parameters:
Query the protocol parameters:

```shell
cardano-cli latest query protocol parameters --out-file pparams.json
```

Draft the transaction to calculate its transaction fee:
Draft the transaction to calculate its transaction fee:

```shell
cardano-cli latest transaction build-raw \
Expand All @@ -206,16 +211,16 @@ cardano-cli latest transaction calculate-min-fee \
>171089 Lovelace
```

Calculate the change of the transaction. Note that the deposit is not explicitly included, instead, you should deduct the deposit amount (2000000 lovelace) from the change __Change = currentBalance - fee - deposit__:
Calculate the change of the transaction. Note that the deposit is not explicitly included, instead, you should deduct the deposit amount (2000000 lovelace) from the change **Change = currentBalance - fee - deposit**:

Query the protocol parameters to get the deposit amount:
Query the protocol parameters to get the deposit amount:

```shell
cardano-cli latest query protocol-parameters | jq .stakeAddressDeposit
2000000
```
Query the current balance of `payment.addr`:

Query the current balance of `payment.addr`:

```shell
cardano-cli latest query utxo --address $(< payment.addr) --output-json | jq -r .[].value.lovelace
Expand All @@ -226,7 +231,7 @@ cardano-cli latest query utxo --address $(< payment.addr) --output-json | jq -r
change=$((9999834851 - 171089 - 2000000))
```

Build the transaction:
Build the transaction:

```shell
cardano-cli latest transaction build-raw \
Expand All @@ -236,6 +241,7 @@ cardano-cli latest transaction build-raw \
--certificate-file registration.cert \
--out-file tx.raw
```

## Sign and submit the transaction

```shell
Expand All @@ -245,9 +251,8 @@ cardano-cli latest transaction sign \
--signing-key-file stake.skey \
--out-file tx.signed
```

```shell
cardano-cli latest transaction submit \
--tx-file tx.signed
```


Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ keywords: [Governance, constitutional committee, committee, credentials, CIP1694

Individuals or entities nominated as committee members must generate a *cold* credential, which can be either a public key (Ed25519) or a script. This cold credential serves as the primary identifier and is used to authorize a *hot* credential, which is used for voting.

The term 'cold' emphasizes that this credential is stored in a secure, offline environment, such as safeguarded USB drives, isolated computing machines, or other devices deliberately formatted and disconnected from the internet for enhanced security. Conversely, the term 'hot' indicates that this credential is slightly more exposed, as it is more frequently used for signing votes. New hot credentials can be authorized at any point, where a new authorization certificate overrides the previous one.
The term 'cold' emphasizes that this credential is stored in a secure, offline environment, such as safeguarded USB drives, isolated computing machines, or other devices deliberately formatted and disconnected from the internet for enhanced security. Conversely, the term 'hot' indicates that this credential is slightly more exposed, as it is more frequently used for signing votes. New hot credentials can be authorized at any point, where a new authorization certificate overrides the previous one.

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
Expand All @@ -27,13 +27,14 @@ import TabItem from '@theme/TabItem';

The most basic setup for a Constitutional Committee member is using Ed25519 keys. An Ed25519 key pair includes a private key and its corresponding public key. The private key is utilized to create digital signatures, while the public key is employed to verify those signatures. On this setup. the constitutional committee member would generate two sets of keys: *cold* and *hot* and issue an authorization certificate to link them.

### Generate cold key pair:
### Generate cold key pair

```shell
cardano-cli conway governance committee key-gen-cold \
--cold-verification-key-file cc-cold.vkey \
--cold-signing-key-file cc-cold.skey
```

As usual, the ed25519 keys are wrapped on a text envelope:

```json
Expand All @@ -51,7 +52,8 @@ As usual, the ed25519 keys are wrapped on a text envelope:
"cborHex": "5820ffafa2978add44508e2d9d704faf54bccd41fad5f5c312b268c48d32a99c1099"
}
```
### Generate the cold verification key hash:

### Generate the cold verification key hash

```shell
cardano-cli conway governance committee key-hash \
Expand All @@ -63,15 +65,15 @@ cat cc-key.hash
89181f26b47c3d3b6b127df163b15b74b45bba7c3b7a1d185c05c2de
```

The key hash (or script hash) is what identifies the CC member on-chain and would be typically used in the **update committee** governance
The key hash (or script hash) is what identifies the CC member on-chain and would be typically used in the **update committee** governance
action that attempts to add or remove CC members.

Members of the Interim Constitutional Committee are required to share their Cold key hash or Cold script hash to be added to the Conway genesis file.
Members of the Interim Constitutional Committee are required to share their Cold key hash or Cold script hash to be added to the Conway genesis file.

### Generate Hot key pair:
### Generate Hot key pair

After the Chang hardfork, members of the Interim Constitutional Committee are required to generate a _hot key pair_ (or hot script) and
submit an _Authorization Certificate_. This also applies to new Committee members appointed after the interim phase.
After the Chang hardfork, members of the Interim Constitutional Committee are required to generate a *hot key pair* (or hot script) and
submit an *Authorization Certificate*. This also applies to new Committee members appointed after the interim phase.

To generate a hot key-pair run the following command:

Expand Down Expand Up @@ -99,12 +101,11 @@ Hot keys are also ed25519 keys wrapped on a text envelope:
}
```

### Generate the Authorization Certificate:
### Generate the Authorization Certificate

The _Authorization Certificate_ allows the hot credential to act on behalf of the cold credential by signing transactions where votes are cast. If the
The *Authorization Certificate* allows the hot credential to act on behalf of the cold credential by signing transactions where votes are cast. If the
*hot* credential is compromised at any point, the committee member must generate a new one and issue a new Authorization Certificate. A new Authorization Certificate registered on-chain overrides the previous one, effectively invalidating any votes signed by the old hot credential. This applies only to actions that have not yet been ratified. Actions that have been already ratified or enacted by the old hot credential are not affected.


```shell
cardano-cli conway governance committee create-hot-key-authorization-certificate \
--cold-verification-key-file cc-cold.vkey \
Expand All @@ -122,7 +123,7 @@ cat cc-authorization.cert
}
```

### Submit the authorization certificate in a transaction:
### Submit the authorization certificate in a transaction

```shell
cardano-cli conway transaction build \
Expand Down Expand Up @@ -151,15 +152,15 @@ cardano-cli conway transaction submit \

Constitutional Committee members comprising multiple individuals can opt for a multisignature setup using simple scripts.

There are multiple possible setups, in this example we show how [Simple scripts](docs/get-started/cli-operations/simple-scripts/simple-scripts.md) can be used for both the *cold* and the *hot* credentials.
There are multiple possible setups, in this example we show how [Simple scripts](../simple-scripts/simple-scripts.md) can be used for both the *cold* and the *hot* credentials.

Assume Alice, Bob and Carol form an organization "ABC" and the community wishes to appoint "ABC" as a Constitutional Committee member.
Assume Alice, Bob and Carol form an organization "ABC" and the community wishes to appoint "ABC" as a Constitutional Committee member.

### Generate keys for the cold credential:
### Generate keys for the cold credential

Alice, Bob, and Carol need to generate a key-pair for the multisignature cold credential.

Alice:
Alice:

```shell
cardano-cli conway governance committee key-gen-cold \
Expand All @@ -174,6 +175,7 @@ cardano-cli conway governance committee key-gen-cold \
--cold-verification-key-file bob-cold.vkey \
--cold-signing-key-file bob-cold.skey
```

Carol:

```shell
Expand All @@ -182,7 +184,7 @@ cardano-cli conway governance committee key-gen-cold \
--cold-signing-key-file carol-cold.skey
```

### Get verification key hashes:
### Get verification key hashes

To generate a multisignature script, Alice, Bob, and Carol need to obtain their verification key hashes:

Expand All @@ -197,9 +199,10 @@ cardano-cli conway governance committee key-hash --verification-key-file carol-c
da1a4d13a1c951f30a7efb4dac2b4c1f603f4eabbfa0ecc7f361bfc1

```
### Create the multisignature cold script:

Create the multisignature `cold.script` file using the simple scrypt syntax. In this example we use the `atLeast` type, so that 2 out of the 3 keys are required for the script to evaluate to true. To learn more about simple scripts read [this article](docs/get-started/cli-operations/simple-scripts/simple-scripts.md)
### Create the multisignature cold script

Create the multisignature `cold.script` file using the simple scrypt syntax. In this example we use the `atLeast` type, so that 2 out of the 3 keys are required for the script to evaluate to true. To learn more about simple scripts read [this article](../simple-scripts/simple-scripts.md)

```shell
cat cold.script
Expand All @@ -225,7 +228,7 @@ cat cold.script
}
```

### Calculate the script hash:
### Calculate the script hash

The governance action that proposes "ABC" organization as a Committee Member needs to reference their cold script hash. They can obtain it with:

Expand All @@ -234,9 +237,9 @@ cardano-cli hash script --script-file cold.script
ad31d247bb2549db98020c5a6331732ebe559ad85b5768abbda3eb0d
```

### Generate keys for the hot credential:
### Generate keys for the hot credential

If ratified, "ABC" will need to generate a *Hot* credential and an Authorization certificate. Alice, Bob and Carol can follow the exact same workflow from above: Generate Ed25519 key pair for each member, and create a multisignature simple script.
If ratified, "ABC" will need to generate a *Hot* credential and an Authorization certificate. Alice, Bob and Carol can follow the exact same workflow from above: Generate Ed25519 key pair for each member, and create a multisignature simple script.

Alice:

Expand All @@ -245,6 +248,7 @@ cardano-cli conway governance committee key-gen-hot \
--verification-key-file alice-hot.vkey \
--signing-key-file alice-hot.skey
```

Bob:

```shell
Expand All @@ -260,7 +264,8 @@ cardano-cli conway governance committee key-gen-hot \
--verification-key-file carol-hot.vkey \
--signing-key-file carol-hot.skey
```
### Get the hot key hashes:

### Get the hot key hashes

```shell
cardano-cli conway governance committee key-hash --verification-key-file alice-hot.vkey
Expand All @@ -273,7 +278,7 @@ cardano-cli conway governance committee key-hash --verification-key-file carol-h
643f4e3d521675e199e38a6904038057252507fd69b97b9f181912b1
```

### Create the multisignature hot script:
### Create the multisignature hot script

```shell
cat hot.script
Expand All @@ -299,7 +304,7 @@ cat hot.script
}
```

### Calculate the hot script hash:
### Calculate the hot script hash

```shell
cardano-cli hash script --script-file hot.script
Expand All @@ -308,7 +313,7 @@ f5d42214cb2625cfc34e5c0cfb1daceee44a4a3c2e6807ab67cd6adb

### Issue the authorization certificate

The _Authorization Certificate_ allows the hot credential to act on behalf of the cold credential by signing transactions where votes are cast. If the
The *Authorization Certificate* allows the hot credential to act on behalf of the cold credential by signing transactions where votes are cast. If the
*hot* credential is compromised at any point, the committee member must generate a new one and issue a new Authorization Certificate. A new Authorization Certificate registered on-chain overrides the previous one, effectively invalidating any votes signed by the old hot credential. This applies only to actions that have not yet been ratified. Actions that have been already ratified or enacted by the old hot credential are not affected.

```shell
Expand All @@ -321,6 +326,7 @@ cardano-cli conway governance committee create-hot-key-authorization-certificate
### Submit the authorization certificate in a transaction

Build the transaction:

```shell
cardano-cli conway transaction build \
--tx-in "$(cardano-cli query utxo --address "$(< payment.addr)" --output-json | jq -r 'keys[0]')" \
Expand Down Expand Up @@ -381,22 +387,20 @@ cardano-cli conway transaction assemble \
--out-file tx.signed
```

Submit the transaction
Submit the transaction

```shell
cardano-cli conway transaction submit \
--tx-file tx.signed
```


</TabItem>
<TabItem value="plutus-script">

:::info
Please go to [Credential Manager](https://credential-manager.readthedocs.io/en/latest/index.html)
Please go to [Credential Manager](https://credential-manager.readthedocs.io/en/latest/index.html)

It is a suite of Plutus scripts and tools for managing credentials with an X.509 certificate chain, ensuring secure access and operations within the Cardano blockchain for key management and security best practices.
:::
</TabItem>
</Tabs>

Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ In addition to the registered DReps, the system features a couple of default vot
### Prerequisites

* Payment keys and address with funds
* [Registered stake address](docs/get-started/cli-operations/basic-operations/stakeaddress-registration.md)
* [Registered stake address](docs/get-started/cardano-cli/basic-operations/stakeaddress-registration.md)
* DRep ID (key hash or script hash) of a registered DRep.

## Generating the vote delegation certificate

### Generate the vote delegation certificate.
### Generate the vote delegation certificate

* Delegating to the `--always-abstain` default voting option:

Expand All @@ -34,7 +34,7 @@ cardano-cli conway stake-address vote-delegation-certificate \
--out-file vote-deleg.cert
```

* Delegating to the `--always-no-confidence` default voting option:
* Delegating to the `--always-no-confidence` default voting option:

```shell
cardano-cli conway stake-address vote-delegation-certificate \
Expand All @@ -51,6 +51,7 @@ cardano-cli conway stake-address vote-delegation-certificate \
--drep-key-hash $(< drep.id) \
--out-file vote-deleg.cert
```

* Delegating to a **script-based** (i.e. multisignature) registered DRep:

```shell
Expand Down Expand Up @@ -88,4 +89,4 @@ cardano-cli conway transaction sign \
```shell
cardano-cli conway transaction submit \
--tx-file tx.signed
```
```
Loading
Loading