How do I import or export a private key in the Sui CLI?

Import a key with sui keytool import "<suiprivkey... or mnemonic>" ed25519, then list it with sui keytool list. Export one with sui keytool export --key-identity <address-or-alias>, which prints the private key as a Bech32 suiprivkey string you can paste into a wallet such as Slush. Both commands act on the CLI keystore at ~/.sui/sui_config/sui.keystore.

Import a key

The arguments, from keytool.rs:

• Input string: a mnemonic of 12, 15, 18, 21 or 24 words, or a Bech32 string starting with suiprivkey.
• Key scheme: ed25519, secp256k1 or secp256r1.
• Derivation path (optional, mnemonic only): defaults to m/44'/784'/0'/0'/0' for Ed25519, m/54'/784'/0'/0/0 for Secp256k1 and m/74'/784'/0'/0/0 for Secp256r1.
• --alias (optional): must start with a letter and may contain letters, digits, - and _. If you leave it out, the CLI generates one.

To import a second or later account from the same phrase, pass the path for that account index explicitly, for example m/44'/784'/1'/0'/0'.

The CLI rejects hex private keys. If you have an old 64-character hex key, convert it first:

Use the imported address

Importing adds the key but doesn't switch to it. Make it the active address:

See How do I switch networks and addresses in the Sui CLI? for more.

Export a key

The output includes exportedPrivateKey (the suiprivkey1... string) and the key's address, public key and scheme. Add --json for machine-readable output. Exporting gives you a private key, not a recovery phrase. The CLI prints a phrase only once, when you run sui client new-address or sui keytool generate.

Create a new key instead

This generates a key, saves it to the keystore and prints the recovery phrase. sui keytool generate ed25519 instead writes the key to a file in the current directory (Base64 flag || privkey) without adding it to the keystore.

Gotchas

• Shell history. A key or phrase typed on the command line ends up in your shell history. Clear it afterwards, or run the command with a leading space if your shell is set to ignore those.
• Wrong scheme, wrong address. The same phrase gives different addresses for ed25519 and secp256k1. If the imported address doesn't match your wallet, check the scheme and the derivation path.
• Keystore location. Pass --keystore-path to sui keytool to work with a different keystore file.
• The key format. See What format are Sui private keys in? for what is inside a suiprivkey string.

Once the key is imported, get testnet SUI to try it out.

Sources

• Sui CLI keytool reference, Sui documentation
• crates/sui/src/keytool.rs, MystenLabs/sui
• crates/sui/src/client_commands.rs, MystenLabs/sui