Guide for using the Ika CLI tool for dWallet operations, validator management, system deployment, and network administration. Use when performing CLI-based dWallet creation, signing, presigning, key management, validator operations, system initialization, or querying Ika network state via the terminal. Triggers on tasks involving `ika` CLI commands, dWallet CLI operations, Ika system deployment, or MCP tool integration with Ika.
Command-line interface for the Ika decentralized MPC signing network on Sui.
references/commands.md - Full command reference with all flags, arguments, and examplesreferences/json-output.md - JSON output schemas for --json flag on every command# Via Homebrew (macOS/Linux)
brew install ika-xyz/tap/ika
# Or download pre-built binary from GitHub Releases
# https://github.com/dwallet-labs/ika/releases
# Available for: linux-x64, linux-arm64, macos-x64, macos-arm64, windows-x64
# Or build from source
cargo build --release -p ika
Requires: Sui CLI (sui keytool for key management)
All commands support these flags:
| Flag | Description |
|---|
--json | Output results as JSON (machine-parseable). Errors also output as JSON. |
--client.config <PATH> | Custom Sui client config path |
--ika-config <PATH> | Custom Ika network config path (default for all dwallet subcommands) |
--gas-budget <MIST> | Override default gas budget (default for all dwallet subcommands) |
-y, --yes | Skip confirmation prompts |
-q, --quiet | Suppress human-readable output (JSON still printed with --json -q) |
ika
├── start # Start local Ika network
├── network # Network info and addresses
├── dwallet # dWallet operations
│ ├── create # Create dWallet via DKG
│ ├── sign # Request signature
│ ├── future-sign # Conditional/future signing
│ │ ├── create # Create partial user signature
│ │ └── fulfill # Complete future sign
│ ├── presign # Request presign (batch up to 20)
│ ├── global-presign # Global presign with network key
│ ├── import # Import external key as dWallet
│ ├── register-encryption-key
│ ├── get-encryption-key
│ ├── verify-presign
│ ├── get # Query dWallet info
│ ├── list # List owned dWallet capabilities
│ ├── list-presigns # List presign caps by status/curve
│ ├── public-key # Extract signing public key
│ ├── decrypt # Decrypt on-chain encrypted share
│ ├── epoch # Query current network epoch
│ ├── pricing # Current pricing info
│ ├── generate-keypair # Offline keypair generation
│ └── share # User share management
│ ├── make-public
│ ├── re-encrypt
│ └── accept
├── config # Configuration management
│ ├── init # Fetch addresses + create Sui envs
│ ├── add-env # Add env from local ika_config.json
│ ├── sync # Re-fetch latest contract addresses
│ └── show # Show current config
├── validator # Validator operations (30+ subcommands)
├── protocol # Protocol governance (feature-gated)
└── completion # Shell completions (bash/zsh/fish)
Commands accept named values (not numeric IDs):
| Parameter | Accepted values |
|---|---|
--curve | secp256k1, secp256r1, ed25519, ristretto |
--signature-algorithm | ecdsa, taproot, eddsa, schnorrkel |
--hash-scheme | keccak256, sha256, double-sha256, sha512, merlin |
# Register encryption key first (derives from active Sui address by default)
ika dwallet register-encryption-key --curve secp256k1
# Create a secp256k1 dWallet (IKA/SUI coins auto-detected from wallet)
ika dwallet create \
--curve secp256k1 \
--output-secret ./my_dwallet_secret.bin
# Output: dWallet ID, Cap ID, Public Key
# Sign a message
ika dwallet sign \
--dwallet-cap-id <CAP_ID> \
--dwallet-id <DWALLET_ID> \
--message <HEX_MESSAGE> \
--signature-algorithm ecdsa \
--hash-scheme keccak256 \
--secret-share ./my_dwallet_secret.bin \
--presign-cap-id <PRESIGN_CAP_ID> \
--wait
The secret share can be provided in three ways (in priority order):
--secret-share <file> — read from a local file--secret-share-hex <hex> — pass directly as hex--dwallet-id.# Create 10 presigns in a single transaction (max 20)
ika dwallet presign \
--dwallet-id <DWALLET_ID> \
--signature-algorithm ecdsa \
--count 10 \
--wait
# List all owned dWallet capabilities
ika dwallet list
# List presign caps grouped by status and curve
ika dwallet list-presigns
# Extract the signing public key from a dWallet
ika dwallet public-key --dwallet-id <DWALLET_ID>
# Query current network epoch
ika dwallet epoch
# Step 1: Create partial user signature
ika dwallet future-sign create \
--dwallet-id <DWALLET_ID> \
--message <HEX_MESSAGE> \
--hash-scheme sha256 \
--presign-cap-id <PRESIGN_CAP_ID> \
--signature-algorithm ecdsa \
--secret-share ./my_secret.bin
# Step 2: Fulfill (complete the sign)
ika dwallet future-sign fulfill \
--partial-cap-id <PARTIAL_CAP_ID> \
--dwallet-cap-id <DWALLET_CAP_ID> \
--dwallet-id <DWALLET_ID> \
--message <HEX_MESSAGE> \
--signature-algorithm ecdsa \
--hash-scheme sha256 \
--wait
Seed derivation: Encryption keys are derived stateless from the active Sui keystore address. Use --seed-file <PATH> for raw 32-byte seed, --address <ADDR> for a specific keystore address, or --encryption-key-index <N> for multiple keys per address. Pass --legacy-hash for keys registered before the V2 hash fix (only affects non-SECP256K1 curves).
Auto-detection: IKA/SUI coins are auto-detected from the active wallet. Curve, DKG output, and presign output are auto-fetched from chain when --dwallet-id and --presign-cap-id are provided.
# Create validator info
ika validator make-validator-info <NAME> <DESC> <IMG_URL> <PROJECT_URL> <HOST> <GAS_PRICE> <ADDRESS>
# Become a validator candidate
ika validator become-candidate <VALIDATOR_INFO_PATH>
# Join the committee
ika validator join-committee --validator-cap-id <CAP_ID>
Sui wallet keys are managed by sui keytool:
sui keytool generate ed25519 # Generate new keypair
sui keytool list # List known keys
sui keytool import <MNEMONIC> # Import key from mnemonic
dWallet encryption keys are derived stateless from Sui keystore addresses (no local file storage). The CLI uses keccak256(keypair_bytes || index) to derive a 32-byte seed, then hashes with domain separators to produce class-groups and Ed25519 keys.
All commands support --json for structured output:
ika dwallet get --dwallet-id <ID> --json
ika dwallet list --json
ika dwallet list-presigns --json
ika validator get-validator-metadata --json