Safety

Treat a seed phrase like rm -rf /.

Three keys

• Custody key. Owns your account. Stays in your wallet. runfcx asks it for two signatures, once.
• App key. Lives in ~/.fcx/key on your laptop. Can cast, like, recast and follow. Expires 30 days after last use.
• Server SSH key. ~/.fcx/ssh_ed25519. Only your IP can reach SSH on the server.

Wallet first

runfcx login --wallet keeps your custody key in your wallet. The seed phrase mode exists for accounts whose key lives only in the Farcaster app. Use it with a test account.

Approving app keys from inside the Farcaster app isn't possible yet. We asked for it upstream.

What runfcx does

• The seed phrase is read hidden, kept in memory, never written or logged.
• Both login modes need a human at the keyboard. An agent can't run them.
• The wallet page listens on 127.0.0.1 only, behind a one-time link.
• The node's API is closed to the internet. runfcx uses an SSH tunnel.