## Keyring

Keys are stored in the `defradb` keyring, which is initialized and unlocked via the `DEFRA_KEYRING_SECRET` environment variable. The variable can also be defined in a `.env` file located in the working directory, or at a filepath defined by the `--secret-file` flag. The secret must be provided every time the node is started.

## Private keys

DefraDB relies on a number of private keys to encrypt or sign data:

- `peer-key`: ed25519 key.  
Backs [P2P features](/p2p/index.md).
- `encryption-key`: AES-128, AES-192, or AES-256 key.  
Used to encrypt data at rest.
- `searchable-encryption-key`: AES-128, AES-192, or AES-256 key.  
Used to produce searchable encrypted artifacts.
- `node-identity-key`: secp256k1 or ed25519 key (defined by [`datastore.defaultkeytype`](/references/config.md#datastore-defaultkeytype)).  
Used for [access control](/security/identity.md) and signatures.

The databases creates keys automatically on startup if they are not found, but you can also generate or import keys manually:

- Generate keys with the CLI command [`defradb keyring new`](/references/cli/defradb_keyring_new.md)
- Import external keys with the CLI command [`defradb keyring add <name> <private-key-hex>`](/references/cli/defradb_keyring_add.md)