We are using @truffle/hdwallet-provider [1] to sign transactions when deploying smart contracts on Besu. All the provided examples left the private key or the mnemonic in plain text in the truffle config file. I would like to use a JSON UTC file.

What is the best way to solve that?

[1] https://www.npmjs.com/package/@truffle/hdwallet-provider

1 Answer 1


If your concern is about security, a general approach is by using package dotenv in order to load environment variables and avoid hardcoding secret keys or mnemonics in your code.

You just need to create a file like this in your root directory:


In this file you can add all the passwords you need, for instance:


Finally, you can add the below code in your Truffle config:

const HDWalletProvider = require("@truffle/hdwallet-provider");
const INFURA_APP_KEY = process.env.INFURA_APP_KEY;

By the way, if you are using Github or similar version controlling, never forget to add this .env file in the .gitignore one to avoid versioning your sensitive information in a repository.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.