Ika CLI

The Ika CLI is the primary tool for interacting with the Ika network. It supports dWallet creation and signing, validator operations, system deployment, and configuration management.

Installation

Install via Homebrew

brew install ika-xyz/tap/ika

Build from Source

git clone https://github.com/dwallet-labs/ika.git
cd ika
cargo build --release --bin ika

The binary will be at target/release/ika.

Download Pre-built Binaries

Pre-built binaries are available from GitHub Releases for:

Linux x64 and ARM64
macOS x64 and ARM64 (Apple Silicon)
Windows x64

Prerequisite

The Ika CLI uses the Sui CLI for key management and on-chain operations. Make sure you have it installed before using Ika.

Initial Configuration

After installation, initialize the CLI config to fetch deployed contract addresses:

ika config init

This fetches the current mainnet and testnet contract addresses from GitHub, writes ~/.ika/ika_sui_config.yaml, and creates Sui CLI environments (ika-testnet, ika-mainnet) pointing to the correct RPC URLs.

Then switch to the desired environment:

sui client switch --env ika-testnet

To re-fetch the latest contract addresses after upgrades:

ika config sync

Global Flags

All commands support these flags:

Flag	Description
`--json`	Output results as JSON (machine-parseable)
`--client.config <PATH>`	Custom Sui client config path
`--ika-config <PATH>`	Custom Ika network config path
`--gas-budget <MIST>`	Override default gas budget
`-y, --yes`	Skip confirmation prompts
`-q, --quiet`	Suppress human-readable output (JSON still printed with `--json -q`)

Command Overview

ika
├── dwallet                    # dWallet operations
│   ├── create                 # Create dWallet via DKG
│   ├── sign                   # Request signature (--wait for result)
│   ├── future-sign            # Conditional/future signing
│   │   ├── create             # Create partial user signature
│   │   └── fulfill            # Complete future sign
│   ├── presign                # Request presign (--count for batch, --wait)
│   ├── global-presign         # Global presign with network key
│   ├── import                 # Import external key as dWallet
│   ├── register-encryption-key
│   ├── get-encryption-key
│   ├── verify-presign
│   ├── get                    # Query dWallet info
│   ├── list                   # List owned dWallet capabilities
│   ├── list-presigns          # List presign caps by status/curve
│   ├── public-key             # Extract signing public key
│   ├── decrypt                # Decrypt on-chain encrypted share
│   ├── epoch                  # Query current network epoch
│   ├── pricing                # Current pricing
│   ├── generate-keypair       # Offline keypair generation
│   └── share                  # User share management
│       ├── make-public
│       ├── re-encrypt
│       └── accept
├── validator                  # Validator operations (29 subcommands)
├── config                     # Configuration management
│   ├── init / add-env / sync / show
├── start                      # Start local Ika network
├── network                    # Display network info
└── completion                 # Shell completions (bash/zsh/fish)

Curves, Algorithms, and Hash Schemes

Commands accept named values (not numeric IDs):

Parameter	Accepted values
`--curve`	`secp256k1`, `secp256r1`, `ed25519`, `ristretto`
`--signature-algorithm`	`ecdsa`, `taproot`, `eddsa`, `schnorrkel`
`--hash-scheme`	`keccak256`, `sha256`, `double-sha256`, `sha512`, `merlin`

Quick Start

Create a dWallet and Sign

# 1. Register an encryption key (derives from active Sui address by default)
ika dwallet register-encryption-key --curve secp256k1
 
# 2. Create a dWallet (IKA/SUI coins auto-detected from wallet)
ika dwallet create \
  --curve secp256k1 \
  --output-secret ./my_secret.bin
 
# 3. Request a presign (batch of 5, wait for completion)
ika dwallet presign \
  --dwallet-id <DWALLET_ID> \
  --signature-algorithm ecdsa \
  --count 5 \
  --wait
 
# 4. Sign a message (wait for result)
ika dwallet sign \
  --dwallet-cap-id <CAP_ID> \
  --dwallet-id <DWALLET_ID> \
  --message <HEX_MESSAGE> \
  --signature-algorithm ecdsa \
  --hash-scheme keccak256 \
  --secret-share ./my_secret.bin \
  --presign-cap-id <PRESIGN_CAP_ID> \
  --wait

Auto-detection

IKA/SUI coins are auto-detected from the active wallet. When --dwallet-id is provided, the curve and DKG output are auto-fetched from chain. The presign cap is auto-verified if unverified. The secret share can also be omitted — the CLI will decrypt it from chain using your keystore-derived key.

Key Management

Ika delegates key management to the Sui CLI:

sui keytool generate ed25519    # Generate new keypair
sui keytool list                # List known keys
sui keytool import <MNEMONIC>   # Import from mnemonic

dWallet encryption keys are derived stateless from the active Sui keystore address (no local file storage). The CLI uses keccak256(keypair_bytes || index) to derive a 32-byte seed, then hashes with domain separators to produce class-groups and Ed25519 keys. Use --seed-file <PATH> for raw 32-byte seed, --address <ADDR> for a specific keystore address, or --encryption-key-index <N> for multiple keys per address. Pass --legacy-hash for keys registered before the V2 hash fix (only affects non-SECP256K1 curves).

Shell Completions

# Bash
ika completion bash > /etc/bash_completion.d/ika
 
# Zsh
ika completion zsh > "${fpath[1]}/_ika"
 
# Fish
ika completion fish > ~/.config/fish/completions/ika.fish

JSON Output

All commands support --json for structured output suitable for scripting:

ika dwallet create --curve secp256k1 --json
ika dwallet list --json
ika dwallet list-presigns --json
ika dwallet public-key --dwallet-id <ID> --json

On errors, JSON mode returns {"error": "description"} with exit code 1.

On this page