Calidus Keys

A Calidus key lets you prove you operate your stake pool without ever touching your cold key. Our application form asks for yours so we can confirm your pool automatically.

Supplying a Calidus ID is optional — if you do not have one yet, apply anyway and we will verify your pool by hand. It is worth setting one up though, and not only for us: Calidus keys are becoming the standard way SPOs authenticate across the Cardano ecosystem, from governance tools to explorers to APIs. Registering one takes a single cold-key signature, and this page walks you through it.

We only ever ask for the public Calidus ID — the string beginning calidus1. Never share your .skey file, your mnemonic, or your cold key with us or with anyone else.

What a Calidus key is

A Calidus key is an Ed25519 key pair that you register on chain against your pool, defined by CIP-151 and CIP-88 v2. Registering it takes one signature from your cold key. After that the Calidus key stands in for your pool identity everywhere else — governance tools, explorers, APIs and services like this one — so your cold key can go back into cold storage and stay there.

The public half is called your Calidus ID. It is a 61-character string starting with calidus1, and it is public information published on chain. Sharing it is safe.

Do you already have one?

Enter your pool ID below and we will build the Koios lookup link for you. Either format works — 56-character hex or Bech32 starting with pool1.

Your pool ID

Enter your pool ID and we will build the lookup link for you.

Registered keys are also shown on your pool's page on AdaStat.

Generating a key

You need cardano-signer version 1.34.0 or later. There are two ways to generate the key, and the choice matters later, so it is worth a moment now.

Option A — with mnemonics, restorable in a wallet

This derives the key at 1852H/1815H/0H/0/0, which means the mnemonic can be restored into a light wallet such as Eternl or Typhon. Choose this if you want to sign from a wallet later rather than from the command line.

cardano-signer keygen \
    --path calidus \
    --out-skey myCalidusKey.skey \
    --out-vkey myCalidusKey.vkey \
    --out-id myCalidusKey.id \
    --out-mnemonics myCalidusKey.mnemonics

Option B — key files only

A plain key pair with no mnemonic. Simpler, but no wallet can hold it, so every future signature has to come from the command line.

cardano-signer keygen \
    --out-skey myCalidusKey.skey \
    --out-vkey myCalidusKey.vkey

Either way, treat .skey and the mnemonic words like any other secret: back them up offline, and do not put them on the machine running your block producer if you can avoid it.

Registering it against your pool

Registration is what actually binds the key to your pool. It is the one step that needs your cold key, so run it on your air-gapped machine.

cardano-signer sign --cip88 \
    --calidus-public-key myCalidusKey.vkey \
    --secret-key myPoolCold.skey \
    --json \
    --out-file myCalidusRegistration.json

Then submit that JSON as transaction metadata from an online machine, under metadata label 867. In Eternl v2 you can do this through the Custom Metadata feature with conversion set to Basic Conversions, which converts the 0x… strings in the file into byte arrays for you.

Registration can be updated later by submitting again with a higher nonce, or revoked by registering an all-zeroes key. Once the transaction is on chain, your Calidus ID is the --out-id value from generation, and the Koios check above will return it.

What we do with it

When you submit an application with a Calidus ID, we look up your pool on Koios and check that the ID you gave matches the one registered on chain. That confirms the pairing is genuine. If it does not match, the form tells you and nothing is recorded — usually it means one of the two values was pasted wrong.

We do not ask you to sign anything, so this is a check rather than a proof of control: Calidus IDs are public, so in principle anyone could copy yours. It is enough for sorting applications, and it saves you a manual verification step. If your pool is not found or Koios is unavailable, your application still goes through and we follow up by hand.