What is the best way to store the private key to sign transactions on web3js

Question

So I have a web3js script(bot), something along these lines:

let walletAddress = ""
let pvtKey = ""

signed = await web3.eth.accounts.signTransaction(txObject, pvtKey);

What is the best practise to not have the private key in plain text? I can read it from a file, but if the attacker can escalate his privileges he can also read it from the file.

Using webjs encrypt/decrypt functionality doesn't help either cause in this case I would have the password visible in the script (assuming attacker was able to escalate privileges) so I would just be delaying the problem.

Reading from a vault from azure or aws I guess would be the same if he can get to my script.

What could be the best way to do this without being a hardware wallet (because this is a bot that is constantly posting transactions).

Answer 1

you should use the dotenv package.

Then you create a .env file and put all such important keys there. For example, the .env file should look like this:

PRIVATE_KEY=okdoqkdoqdefleifhelkslksnhlfksefkl

The file where you wish to use this key, has to access it like this:

require('dotenv').config() //This configures the usage of the file.

Now you may use it in that file as:

signed = await web3.eth.accounts.signTransaction(txObject, process.env.PRIVATE_KEY);

Similarly, you can store other keys and access them too.

Important: Include .env file in .gitignore or else if this is posted shall make the keys vulnerable.