Quickstart

What you will complete

By the end of this guide:

• your Co-Signer API key is active;
• your Co-Signer is online;
• your organization MPC key is active;
• testnet wallet operations are ready;
• your first ledger account and wallet can be created.

Install both BroSettlement Agent Skills from https://github.com/BroLabel/brosettlement-agent-skills.

Clone or download the repository and inspect both `SKILL.md` files and the bundled scripts. Ask me which skills directory this AI agent supports, then install `brosettlement-onboarding` and `brosettlement-api` as sibling folders without overwriting existing skills. Verify that both skills are available, then activate `$brosettlement-onboarding` and guide me through configuring a new BroSettlement testnet organization. If automatic installation is not supported, tell me the exact destination directory and next action instead of claiming success.

Prerequisites

Before you begin, make sure you have:

• a BroSettlement organization on the Free/Testnet plan;
• access to a Linux or macOS server that can make outbound HTTPS requests;
• Git;
• Go 1.24 or later;
• OpenSSL;
• a secure location for the API private key, share-encryption key, and encrypted MPC share files.

1. Generate an Ed25519 API key pair

Generate the key pair on your own machine or server:

openssl genpkey -algorithm ED25519 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem
chmod 600 private.pem

BroSettlement only needs public.pem. Keep private.pem on infrastructure you control. Do not upload it to BroSettlement, send it through support, or commit it to Git.

Display the contents of public.pem and copy the complete block, including both boundary lines:

cat public.pem

2. Create the Co-Signer API key

This is a manual user checkpoint. The Onboarding Agent Skill provides these instructions but never opens or operates the API Keys Console UI and never creates, edits, rotates, or revokes an API key.

In the BroSettlement Console:

1. Open API Keys.
2. Select Create API key.
3. Enter a recognizable name, such as Testnet Co-Signer.
4. Paste the complete public PEM block into Public key (PEM), including the BEGIN PUBLIC KEY and END PUBLIC KEY lines.
5. Complete IP whitelist (CIDR). For temporary staging/testnet onboarding, you may enter

0.0.0.0/0 to accept requests from any IPv4 address and effectively bypass the IP restriction while testing. This setting is intentionally permissive. Never use 0.0.0.0/0 in production; specify the correct narrow public egress IP or CIDR of the server running the Co-Signer or API client before activating a production key.

1. Expand the MPC permission group.
2. Select all three required scopes:

- Initialize MPC — start MPC initialization; - Read MPC — read MPC status and metadata; - Raw MPC co-signer — access Co-Signer protocol endpoints.

1. Create the key and return to the API Keys list.
2. Find the new key, select View, then click the copy button beside Key ID on the key

details page. Store the copied API Key ID securely.

3. Install and start the Co-Signer

Clone and build the open-source Co-Signer:

git clone https://github.com/BroLabel/brosettlement-mpc-co-signer.git
cd brosettlement-mpc-co-signer
go mod download
go test ./...
go build -o ./bin/co-signer ./cmd/co-signer

Create protected persistent storage and a separate encryption secret:

mkdir -p ./data/shares
chmod 700 ./data/shares
openssl rand -base64 32 > share-encryption.key
chmod 600 share-encryption.key

Configure the service. For the staging Console, use the staging BroSettlement API URL directly; you do not need to copy or request a separate Monolith URL.

export CO_SIGNER_MONOLITH_URL="https://brosettlement-staging-api.brolabel.io/"
export CO_SIGNER_API_KEY_ID="<API_KEY_ID>"
export CO_SIGNER_API_PRIVATE_KEY="$(cat /secure/path/private.pem)"
export CO_SIGNER_SHARE_ENCRYPTION_KEY="$(cat /secure/path/share-encryption.key)"
export CO_SIGNER_SHARES_DIR="./data/shares"
export CO_SIGNER_HTTP_ADDR="127.0.0.1:8081"

./bin/co-signer

Keep this process running. For a long-lived deployment, inject secrets through your service manager or secret-management platform instead of storing them in a shell profile or committed .env file.

4. Verify the Co-Signer

Check the local health endpoint from the Co-Signer host:

curl --fail http://127.0.0.1:8081/health

A ready service returns HTTP 200 with:

{
  "status": "ok",
  "ready": true,
  "version": "0.1.0",
  "capabilities": {
"dkg": true,
"sign": true
  }
}

Return to the BroSettlement Console and confirm that the Co-Signer status changes to Online.

5. Initialize MPC

1. Open Multi-Party Computation in the BroSettlement Console.
2. Confirm that the Co-Signer status is Online.
3. Select Initialize MPC.
4. Confirm the initialization request.
5. Keep the Co-Signer online until Distributed Key Generation completes.

Do not restart the Co-Signer, rotate its API key, change the share-encryption key, or delete the shares directory during initialization.

Initialization is complete when:

• the MPC key status is Active or Ready;
• the Co-Signer is Online;
• the required testnet chains show Ready.

6. Create your first wallet

After MPC becomes ready:

1. Open Accounts and create a ledger account.
2. Open Wallets and select Create wallet.
3. Select the new account.
4. Select a testnet chain, such as TRON Nile.
5. Create the wallet and confirm that its status is Active.

When the Agent Skill performs this tutorial, your original onboarding request authorizes one staging/testnet ledger account and one linked wallet, so it does not ask for a redundant confirmation before each create. It reads each resource back by ID, reports successful creation, and returns the sanitized API details. You can retrieve the complete lists later with:

@brosettlement api GET '/api/v1/ledger/accounts'
@brosettlement api GET '/api/v1/wallets'
@brosettlement api GET '/api/v1/ledger/accounts/<accountId>/wallets'

The same resources are visible in BroSettlement Console under Accounts and Wallets.

You can now fund the address with a supported testnet asset and test a deposit. For TRON Nile:

• request test tokens from the TRON Nile faucet;
• see the official TRON testnet-token guide for documented community faucet alternatives;
• verify the public transaction in the Nile explorer.

Confirm the asset is currently supported before requesting it. Enter only the wallet's public TRON Nile address in a faucet. A faucet never needs your seed phrase or private key, and you must not send mainnet assets to a testnet address. Test a withdrawal separately after confirming the required API scopes and keeping the Co-Signer online.