> For the complete documentation index, see [llms.txt](https://docs.fast.poker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fast.poker/for-operators-dealer-service/security-and-key-management.md).

# Security and key management

Run the gas-paying keys hot. Keep the earning key cold. Rotate anything that leaks.

## Wallets and what each holds

An operator setup uses distinct wallets so a hot-key compromise can't reach your earnings or your license.

| Wallet                        | Holds                                      | Where                |
| ----------------------------- | ------------------------------------------ | -------------------- |
| Operator/payer wallet         | Only SOL for gas                           | Hot, on the server   |
| Optional L1 fee payer         | SOL for L1 fees                            | Hot, on the server   |
| Credited earner (`credit_to`) | Dealer license + receives rewards          | Cold, off the server |
| Per-instance `teePayer`       | Funded escrow (ER + L1) for ScheduleCommit | Hot, on the server   |

## Keep the earner cold

Use `credit_to` so the licensed, earning wallet never loads on the server. Run a hot, throwaway, license-less payer that only holds gas.

If that hot key leaks, the attacker gets gas money, not your earnings and not your license.

See [Reward routing (credit\_to)](/for-operators-dealer-service/credit-to-routing.md).

## Key hygiene

* Keypair files should be mode `0600`.
* Never commit keypairs. The repo gitignores `*keypair*.json`, `.env*`, and scratch files matching `_*.mjs` / `_*.ts` / `_*.js`.
* Keep RPC API keys out of committed files. Put them only in `crank-config.json` / `.env`, both gitignored.

## Rotate leaked RPC keys

If an RPC API key (for example a Helius key) has ever appeared in a scratch script, a shared paste, or a committed file, rotate it at the provider.

Many RPC keys grant paid quota, and some grant write or streaming access. Treat any exposure as a full leak.

## Per-instance teePayer isolation

In a fleet, each TEE-committing instance must use its OWN `teePayer` keypair. A shared `teePayer` collides on ScheduleCommit fee accounting.

See [Fleet and sharding setup](/for-operators-dealer-service/fleet-setup.md).