Import Fireblocks Private Keys

This page describes how to import private keys from a Fireblocks wallet.

We recommend that you learn more about this process and its prerequisites before you proceed.

Before you begin

To perform a migration, you will need all of the following:

The list of derivation paths for each Fireblocks wallet you want to import — ask the Fireblocks support team for help retrieving them.
Your backup.zip file - created in the Fireblocks console under In-house key backup by uploading a public.pem key.
The private.pem key corresponding to that public key.
The private.pem password — the password that encrypts your private.pem key. This is not the same as the passphrase, below.
The passphrase of the Fireblocks user who created the backup.zip. This is that user's personal passphrase, generated when they first set up their Fireblocks account.

If any item is missing, obtain it from Fireblocks before starting the migration.

For items 2, 3, and 4, it is generally best to generate a new encrypted RSA key pair by running these commands locally on a trusted computer:

# Generate the private key with DEK headers
openssl genrsa 4096 | openssl rsa -aes256 -passout pass:CHOOSE_YOUR_PASSWORD -traditional -out private.pem

# Derive the public key
openssl rsa -in private.pem -outform PEM -pubout -out public.pem

Then use public.pem to create a new backup package from the Fireblocks web console.

⚠️ If you generated an in-house backup on the Fireblocks console in the past, check how your private.pem key is encrypted. The migration requires the key to be in this format:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,3CF398F62E56D06A6EBC275ED247766F
If your key is in a different format, such as:
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQ/ncIII9edQDd6ZyP
generate a new key pair with the commands above and create a new backup in the Fireblocks console.

Your Fordefi workspace must also be created with key import enabled. If it was not, contact Fordefi support before you begin. We will create a dedicated workspace for the migration.

Import steps

Create an API user with Trader role in your Fordefi workspace and save its access token (JWT) locally — every API call below is authenticated with it.

Base64-encode your Fireblocks backup.zip with the following command:

base64 -i ./fireblocks_backup_zip_file.zip -o base64_encoded_backup_zip_file.txt

Encrypt your private.pem key with the following command. This creates a secure, text-based representation of the key that you can safely transmit to Fordefi. Fordefi can then decrypt it with the corresponding private key:
```
openssl cms -encrypt -in YOUR_RSA_KEY.pem -recip cert.pem -aes256 -outform DER | base64 > base64_encoded_rsa_key.txt
```
To run this command, download Fordefi's cert.pem and place it in the directory where you run the command. Contact Fordefi support to obtain a copy of the file.
Upload the encrypted key material. To start the import process, you will need the relevant key material, which can include the encrypted shares package and decryption key. You can either:
- Contact Fordefi support to initiate the import process.
- Call the Import Keys API at https://api.fordefi.com/api/v1/organizations/import-keys, with the API user's JWT in the Authorization header.

Here is a sample payload:

{
  "type": "fireblocks",
  "key_name": "<THE NAME OF THE KEY TO IMPORT>",
  "backup_zip_content": "<BASE64 ENCODED CONTENT OF YOUR FIREBLOCKS BACKUP ZIP FILE>",
  "encrypted_rsa_pem": "<BASE64 ENCODED CONTENT OF YOUR BACKUP DECRYPTION KEY IN PEM FORMAT>",
  "rsa_pem_password": "<THE PASSWORD FOR THE BACKUP DECRYPTION KEY>"
}

You can upload encrypted_rsa_pem to decrypt the enclave shares within backup_zip_content. Alternatively, you can use the following fixed public key to encrypt the shares, in which case you need to omit the encrypted_rsa_pem and rsa_pem_password fields. The Fordefi enclave holds the corresponding private key.

The response contains a set of keys, each with its own ID. Here is a sample response:

{
  "keys": [
    {
      "key_id": "1e779c8a-6786-4c89-b7c3-a6666f5fd6b5",
      "key_name": "native-ecdsa",
      "key_type": "ecdsa_secp256k1",
      "key_origin": "native",
      "xpub": "xpub661MyMwAqRbcGE6Hjdqf5sQgNEAUAnghFLKBPQEGug3U1HG1sy4MLhEPLjUyyFfYvy45wMHQjAYEk7nHRznCwWSqi3WBQve7UWu1dXemXyv",
      "public_key_compressed": "A6YrN9ak58u3pOQHUossG2oFoVIPxvPP/b0fXkiMEJR8"
    }
  ]
}

Decrypt the key and run the MPC protocol. After you upload the key, all workspace admins are notified. When prompted by the Fordefi mobile application, one of them must enter the Fireblocks recovery passphrase to decrypt the mobile share. This is the personal passphrase of the Fireblocks user who created the backup.zip (item 5 under Before you begin). Fordefi then loads the MPC shares into its secure enclaves and the mobile device for use on the platform.
You can now find the new key and its ID in the response to a call to the List Keys endpoint. Several keys with different key_type values may be listed. When you derive vaults from them:
- Use your ecdsa_secp256k1 key for Bitcoin, EVM, and Cosmos chains.
- Use your eddsa_ed25519 key for Aptos, Solana, and Sui.

Next step

Continue to Create Imported Vaults. These vaults will be derived from the imported Fireblocks keys.

Important: Replace every derivation path placeholder in the examples below with the exact derivation path provided by Fireblocks for that wallet, as described in item 1 under Before you start. Do not reuse a path from another wallet.

For example, to create an EVM vault:

curl -i -X POST \
https://api.fordefi.com/api/v1/vaults \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Content-Type: application/json' \
-d '{
  "name": "the_name_of_the_wallet",
  "import_vault": {
    "derivation_path": "<FIREBLOCKS_DERIVATION_PATH>",
    "key_id": "KEY_ID"
  },
  "type": "evm"
}'

To create a Cosmos vault:

curl -i -X POST \
https://api.fordefi.com/api/v1/vaults \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Content-Type: application/json' \
-d '{
  "name": "the_name_of_the_wallet",
  "import_vault": {
    "derivation_path": "<FIREBLOCKS_DERIVATION_PATH>",
    "key_id": "KEY_ID"
  },
  "type": "cosmos"
}'

To create a Bitcoin vault:

curl -i -X POST \
https://api.fordefi.com/api/v1/vaults \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Content-Type: application/json' \
-d '{
  "name": "the_name_of_the_wallet",
  "chain": "bitcoin_mainnet",
  "import_vault": {
    "default_address_derivation_path": "<FIREBLOCKS_DERIVATION_PATH>",
    "default_address_name": "the_name_of_the_default_address_for_that_wallet",
    "key_id": "KEY_ID"
  },
  "type": "utxo"
}'

To create a Sui vault:

curl -i -X POST \
https://api.fordefi.com/api/v1/vaults \
-H 'Authorization: Bearer <YOUR_JWT_HERE>' \
-H 'Content-Type: application/json' \
-d '{
  "name": "the_name_of_the_wallet",
  "import_vault": {
    "derivation_path": "<FIREBLOCKS_DERIVATION_PATH>",
    "key_id": "KEY_ID"
  },
  "type": "sui"
}'

Import Fireblocks Private Keys

Before you begin

Import steps

Next step

Was this helpful?