hardhat-kms docs ​

hardhat-kms is a Hardhat 3 plugin that signs transactions, messages and typed data with secp256k1 keys held in AWS KMS, Google Cloud KMS and Azure Key Vault. The private key never leaves the KMS.

Each page except the generated API reference opens with an Audience: line that names who it is for and what it assumes. Release channels and versioning says which release to install and what a version promises.

Start here ​

• I need a key and want a first deploy: Deploy a Hardhat contract to Sepolia with AWS KMS, Google Cloud KMS or Azure Key Vault.
• I already have a secp256k1 key in a KMS: start at step 2 of the setup guide for AWS KMS, Google Cloud KMS or Azure Key Vault.
• I want to deploy my contracts: Deploy with Hardhat Ignition.
• I want CI to sign with no stored credentials: Sign from GitHub Actions with OIDC.
• A command or script failed: Errors has every error with its cause and fix. Search the page for a fixed part of the message.
• I sent a transaction and do not know what happened: Recover from an uncertain transaction send.
• Who signed with this key, and when: Find who signed with a key.
• What does the plugin protect against: Security model.
• Should I use a KMS key at all: compare it with a private key in .env, a Ledger and other KMS signers.
• Is the package I installed the real one: Verify a release.
• I want a KMS account in my own code: Library accounts.

Tutorials ​

Using the plugin ​

Runnable projects for viem, ethers and Ignition are in examples/. Pages not written yet are listed under Planned pages.

Contributing ​