Manage BAP (Bitcoin Attestation Protocol) identity files using bap-cli. This skill should be used when users need to create, decrypt, list, or extract BAP identity backups, work with .bep encrypted files, or generate test fixtures for Playwright tests involving BAP identities.
This skill enables comprehensive management of BAP (Bitcoin Attestation Protocol) identity files using two complementary command-line tools:
Use this skill when working with encrypted BAP identity backups (.bep files), creating new identities, extracting member identities, encrypting/decrypting JSON files, or generating test fixtures.
Verify both tools are installed:
bap --version
bbackup --version
git clone https://github.com/b-open-io/bap-cli.git
cd bap-cli
bun install
bun run build
bun link
git clone https://github.com/rohenaz/bitcoin-backup.git
cd bitcoin-backup
bun install
bun run build
bun link
Choose the appropriate tool based on the task:
When users request a new BAP identity, use the bap new command with appropriate backup type:
Type42 backups (recommended for simplicity):
bap new --type type42 --password <password> --name "<name>" --output <file.bep>
Legacy (BIP32) backups (for hierarchical deterministic wallets):
bap new --type legacy --password <password> --name "<name>" --output <file.bep>
Important: Always use strong passwords. The password encrypts the backup file and cannot be recovered if lost.
When users need to see what identities are in a backup file, use bap list:
bap list <backup.bep> --password <password>
This displays:
Use this before extracting member identities to determine the correct index.
When users need to extract a single identity from a master backup (common for distributing individual identities), use bap member:
bap member <master.bep> --password <password> --index <index> --output <member.bep>
The index is zero-based. To find the correct index:
bap list on the master backupWhen users need to view the contents of an encrypted backup, use bap export:
bap export <backup.bep> --password <password>
This outputs the decrypted JSON structure. Use this to:
Optionally save re-encrypted version:
bap export <backup.bep> --password <password> --output <new.bep>
When users have JSON data that needs encryption:
bbackup enc <input.json> -p <password> [-o <output.bep>]
Use cases:
Example:
# Create JSON file
echo '{"wif":"L5EZftvrYa...","label":"My Key"}' > wallet.json
# Encrypt it
bbackup enc wallet.json -p "strongpass" -o wallet.bep
When users need to inspect encrypted .bep files:
bbackup dec <input.bep> -p <password> [-o <output.json>]
Use cases:
Example:
# Decrypt to JSON
bbackup dec identity.bep -p "password" -o identity.json
# View contents
cat identity.json
When users have older backups with weaker encryption (100k iterations):
bbackup upg <old.bep> -p <password> -o <upgraded.bep>
This upgrades to 600,000 PBKDF2 iterations (NIST recommended).
Use cases:
When users need to examine a BAP identity created by bap-cli:
# Create identity with bap-cli
bap new --type type42 --password pass123 --name "Alice" --output alice.bep
# Decrypt with bbackup to inspect
bbackup dec alice.bep -p pass123 -o alice.json
# View the JSON structure
cat alice.json
# Shows: { "ids": "...", "rootPk": "...", "label": "Alice", "createdAt": "..." }
This is useful for:
When users need to re-encrypt a backup with a different password:
# Decrypt with old password
bbackup dec identity.bep -p "oldpass" -o identity.json
# Re-encrypt with new password
bbackup enc identity.json -p "newpass" -o identity-new.bep
# Clean up temporary file
rm identity.json
When users have older BAP identities that need stronger encryption:
# Upgrade directly (maintains same password)
bbackup upg old-identity.bep -p "password" -o identity-upgraded.bep
# Verify it works with bap-cli
bap list identity-upgraded.bep --password password
When users need to extract and modify a member identity:
# Extract member with bap-cli
bap member master.bep --password pass --index 0 --output member.bep
# Decrypt to JSON with bbackup
bbackup dec member.bep -p pass -o member.json
# Modify JSON as needed (e.g., change label)
# ... manual editing or script ...
# Re-encrypt modified version
bbackup enc member.json -p pass -o member-modified.bep
When users encounter problems with backups:
bap list problematic.bep --password password
bbackup dec problematic.bep -p password -o debug.json
cat debug.json | jq . # Pretty print if jq is available
When users need BAP identities for Playwright or automated testing, use the programmatic API:
import { createType42Backup } from "bap-cli";
// Generate backup with multiple test identities
const backup = await createType42Backup("testpassword123", [
{ name: "Test User 1" },
{ name: "Test User 2" },
]);
// Save to file
await backup.saveTo("/tmp/test-backup.bep");
// Get identity keys for assertions
const keys = await backup.getIdentityKeys();
// Extract member backup for specific identity
const memberBackup = await backup.getMemberBackup(0);
// Clean up temp files when done
await backup.cleanup();
This approach is more efficient than CLI for test automation as it:
All BAP identity files use the .bep extension (Bitcoin Encrypted Payload):
Master backups (from bap-cli):
{ ids, rootPk/xprv, label?, createdAt? }Member backups (from bap-cli):
{ wif, id, label?, createdAt? }Encryption (used by both tools):
"Error: type must be 'legacy' or 'type42'"
"Error: Invalid index"
bap list first to see available indicesDecryption failures
"bap: command not found"
"Decryption failed"
"Invalid backup format"
enc must be valid JSONcat file.json | jq ."Password too short"
which bap bbackup
echo '{"test":"data"}' > test.json
bbackup enc test.json -p "testpass" -o test.bep
bbackup dec test.bep -p "testpass" -o out.json
diff test.json out.json # Should match
rm test.json test.bep out.json
file backup.bep # Should show ASCII text (base64)
head -c 50 backup.bep # Should show base64 characters
Complete command reference and advanced usage:
bap-cli: See references/bap-cli-reference.md for:
bbackup: See references/bbackup-reference.md for:
# 1. Create master identity
bap new --type type42 --password masterpass --name "Org Master" --output master.bep
# 2. Verify contents
bbackup dec master.bep -p masterpass -o master.json
cat master.json
# 3. Extract member for distribution
bap member master.bep --password masterpass --index 0 --output member-alice.bep
# 4. Distribute member.bep to Alice
# 1. Receive old backup
# old.bep (using 100k iterations)
# 2. Upgrade encryption
bbackup upg old.bep -p "password" -o new.bep
# 3. Verify with BAP tools
bap list new.bep --password password
// In test file
const backup = await createType42Backup("testpass", [
{ name: "Test Identity" }
]);
await backup.saveTo("/tmp/test.bep");
// Run tests using /tmp/test.bep
await backup.cleanup(); // Removes temp files