(Part 1/2) NEAR accounts & keys: full access keys, and function-call access keys

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:00

   hey folks we are going to talk about near accounts and near keys it's going to be really interesting as this works quite uniquely at near protocol um so we are going to start the very beginning with wallet on testnet and just see how everything is working and then try out different ways of using the full access keys and function call access keys so what we are seeing right now is wallet.testnet.near.org when you go there and you have no

2. 0:31

   account you'll see something like this if you already have an account you can get there by going up here and selecting create new account let's just simply try something that hasn't been taken amazingly videos.testnet is available so grab your cool names right now um create an account different options here we do have ledger support we have email recovery phone recovery uh for now i'm going to use recovery phrase so here is the seed phrase so we are going to copy

3. 1:02

   this say continue it's going to ask us word number seven word number seven happens to be vote okay so this next step says enable two-factor authentication this is going to be a really interesting video for later about how keys work but that will be a bit too complicated for right now so let's pause for a second and look up here upper right hand corner we see videos.testnet so let's look at what keys we have for this account as it stands we're going to be using

4. 1:41

   a cli tool called near cli once you have that installed there's a number of commands you can get to let's just type near to list them out as you can see there is create account state delete a bunch of these we have some good documentation on this we will get to this later the thing that we are going to look at right now is keys so near keys and then you're going to give account id

5. 2:07

   view the account public keys okay so let's do that near keys videos.testnet so we have two keys so interesting what's going on we just created an account we have not done 2fa on it to full access keys which is interesting so if you open up your developer tools usually by right clicking inspect you will see this deal there's a bunch of different tabs we're going to be on the application tab on the left hand side you can see storage then there's local storage and here is all of the local storage

6. 2:48

   that is for this particular site i have already filtered it by this new account so now it is showing us that this is actually the private key in local storage for wallet so here it is plain as day the private key and so let's go back and let's use some tricks on your cli to make sure that this is actually something that looks reasonable we are basically looking to see what are these two keys okay

7. 3:19

   so we have a bunch of different commands with near we also have near repel read evaluate print loop you've seen this before with like node or python or different things once you use near-repel there is a automatic object in there i wouldn't worry about this too much but this is a kind of an interesting way to run things very quickly using our near api js library so it's taking this private key and it's saying okay we're going to grab an object and then there's going to be a public key key on that and let's

8. 4:03

   show the string of that so that comes out as au6 but up if we highlight that search for it sure enough we've got that one so this bottom one is the browser local storage one so what is this this one is our recovery phrase and we can actually tell this by also using near cli near generate and we're putting in our seed phrase and he key pair with 3txaa yep and that is the matching one to this so that is why when you create a brand new account using wallet you have

9. 4:52

   two full access keys next we're going to look at what happens when you use some of our sample apps here we have examples.near.org there's actually a shortcut to this near.dev we'll redirect right back here so let's go to this first one uh guestbook here is a nice readme of how this all works i recommend checking this out there's two buttons at the top browse on github or open in gitpod

10. 5:26

    let's just go to gitpod gitpod is a really neat way to essentially not change your development environment on your computer at all and just do this all on your browser super amazing so this is going to be loading up our guestbook here in a second okay so guestbook is loading and now it just completed in the bottom right hand corner we see there's an open browser button let's just go there

11. 5:56

    cool so now it has created this little interface and we are going to log in with it it's going to say which account do you want to use to log into this we're going to say videos.testnet so now we come back and we can write in this guestbook yeah so we have signed in as videos.testnet so inside of the browser we have a different kind of key that has been stored so what is exactly going on here i think we need to take a little bit of a step back we go back

12. 6:41

    to get pod um let's take a look down here in the terminal so we are starting deployment with this account id dev okay so where did this come from i don't think it's necessary to worry too much about this but essentially there is a repo called near contract helper and we are trying to allow people to use near as easily as possible and that is just automatically helping to create this um kind of a burner account it won't be

13. 7:11

    deleted after a certain amount of time this is yours forever but it has kind of an ugly name so this is actually an account on this vm basically so if we were to look inside of near credentials then there's a folder called default and then inside of there is this account.json so this is actually the unencrypted um key pair so actually let's just uh take a look so it's json account id public key private key so here it is again it's in your

14. 7:52

    the home directory here and when you use near cli and you log in this is also where it'll save it to so let's take a look at what keys we have on this particular account near keys and then this account name cool full access key also i will note that this is talking directly to the chain so we could also do near keys here and it's exactly the same so we have one full access key this wasn't created with wallet this was created programmatically so this is why there's just one on here

15. 8:35

    what's interesting is we have logged in with videos.testnet into the account here which contains this contract basically this account was created the contract of this repository was built and deployed to it so now let's go and take a look so let's take a look at the keys going on here now all right as you can see we've got full access full access and then now we have a new one function call

16. 9:16

    so this is a function call access key this is the first function call access key on this account videos.testnet so this is basically saying we have created a key for this account that is allowed to call this particular contract and has a given allowance of this much near essentially to pay in terms of guess you can explicitly define different method names that can be called if you define none then you are allowed to to call any method on this account so this allowance comes down to

17. 9:57

    uh a bit of near this is kind of small we use yakdoner which is 24 decimal places let's just quickly use another kind of handy tool that we have with near rebel to see how much exact new that is so it's .249 near for this so this is neat so essentially this guest book did not make any new keys it still has just that one full access key but the account that we have logged in here videos.testnet created a function called access key on itself

18. 10:48

    and now it is using that in local storage right here this function call access key can't do powerful actions as we call it in here there are different actions associated here is a list this is at nomicon.io let's make this a bit bigger so we have create account deploy account function call transfer stake add key delete key delete account so you certainly would not want to go into someone's

19. 11:19

    dap and create a function call access key that was able to completely delete the account you can only do that with a full access key and same with all a lot of these other ones i believe the function call here is what function call access keys can do and the rest of them are for full access keys so that was an example of a person logging into a dap and creating a function call

20. 11:53

    access key on their account now there's also a lot of power in creating a function call access kind of on the opposite end of this so imagine that you want to get 100 influencers to start using your dap and they may not have a near account and you give them some invite code or something what you can do is you can actually create a function call access key on the dap side and give the user that key to use the contract itself

21. 12:26

    that a visitor is using would be paying for the gas for this particular user and this we actually did in a demo for a chain link integration in here we actually hard coded a function called access key inside of this let's take a look at what that looks like so let's clear this up so this was near keys client.chainlink.test.net so this had one full access key and then one function call access key so the function call access key

22. 13:08

    it was able to call client.chainlink.testnet is only allowed to call gettokenprice and then it had quite a bit of allowance in our github repo the private key is completely open so anyone can quote unquote steal that private key but all you can do with it is just call this one contract this one method and i think this is like 1900 near if i remember correctly so you know people can go hog wild if they want but i think

23. 13:37

    this really illustrates an interesting part of the the near account systems and how you can really get users to start using your system here is our documentation i think it's important to mention docs.ner.org constantly evolving so i'll show you at the time of this video how the navigation works for this i think it's really important to to know where to find information on the cli that we've been

24. 13:59

    doing so right now it's at basics near cli now we have all these great commands and exactly how to use them you can just use straight up near add key so let's click on this and just see an example of this using the cli we can do a full access key or we can add a function call access key here's what exactly what that would look like feel free to copy this paste it into your terminal play around

25. 14:25

    with it a couple of things to note here we've been using near cli for some of this so let's do this again near keys videos.testnet as a reminder we just got two full access keys this one function call access key down at the bottom we've got three total on wallet we got sections for authorized apps which are essentially function call access keys and full access keys so i can go down here see exactly some details about this function call access key i can click here

26. 14:58

    actually deauthorize it all right so let's go back and let's take a look at the same keys now we're back to the two full access keys so there is some really neat functionality on the wallet side another thing to note is that if you're familiar with the concept of a nonce or nunce it's a number used once there are unique nonces per key so at times you may run into conflicts there's different

27. 15:32

    ways to approach this but essentially having multiple access keys is a great way to avoid nonce collisions so let's recap the different kinds of keys that we talked about for a second here so inside of git pod we have an unencrypted key located in the home directory dot near credentials it looks like this let's copy skye and this is a way to just kind of format it so this is what it looks like that's

28. 16:15

    unencrypted over here we have um a now deleted function call access key but it is still stored in local storage so this is the second kind local storage key and then we discuss briefly the chain link way here is some code and we are going to focus right here this is using near api js we are creating a new key store that's an in-memory key store unencrypted local storage in memory these are basically the three

29. 16:59

    open up this really quickly don't worry if this is above your head this is not really that important but in case folks are watching this and interested this is a file from near api js and we can see that we've got these in memory key store browser local storage key store an encrypted file system key store and then merge key store merge key store is a way to have multiple of these so for instance let's say you're looking in two different directories for keys you can use merge store key to say

30. 17:33

    you know look in the current directory uh look in this sub directory look at my home directory you'd use merge key store and at the top here we do see key store this is these are extending key stores so that is how that's working here we are back at wallet um notice also that this has some nice activity so we can see that that key was deleted recently upper right hand corner we have 499 near so i could use this handy button right

31. 18:04

    here to send some near to mike.test.net just send one confirm and send again this uh browser local storage has the full access key it just dropped down to 498 okay so we're going to do something that's very common with near cli when developing we're going to say near login this is going to automatically open up our wallet yes we are going to allow making a full access key full access

32. 18:50

    awesome close this window closed let's go back here and it says that this has been created successfully so similar to how we saw on git pod this is now inside of our home dot near credentials default videos cool so there it is i'm not going to show the contents of this one so now that we have this i can do things like near send videos dot test that to my dot test net 19 so now we have this unencrypted full access key there

33. 19:37

    gives me a nice little link to go to explorer you can see that 19 year was deposited if we go to our wallet dashboard you see we've dropped down in near so lastly let's clean this up so we're going to delete the two access keys that we have shown the private keys for it's going to be near delete key videos.testnet okay it's working on that and then this other one these were the first two that came when

34. 20:28

    we first created the account let's take a look at near keys videos.testnet so now we just have one full access key and it's the one that lives on my computer that i haven't showed the private key for this is also a demonstration of how you would like rotate keys and and whatnot very easy with the cli very easy with wallet although i think wallet is tries to dissuade you from getting rid of all your keys you absolutely can get rid of all your

35. 20:59

    keys especially if you're writing a smart contract and you want to have a lot of trust around it and you want to make sure that there are zero full access keys let's demonstrate this actually so now this website has no idea that the full access key has been deleted underneath it so let's try the same thing sending mic.testnet a near and this should not yeah error has happened cannot sign transactions for account so yeah this is how all the keys work and accounts work

36. 21:37

    lastly we will talk about top level accounts and sub accounts so here we have a command that we're going to execute and this is going to demonstrate a top level account so a top level account is different than a normal account in the sense that there is no suffix so videos.testnet has the suffix.testnet uh on mainnet it's dot near betanet.betanet etc let's try this saving key there okay unless you notice that this does not end in in dot test net and

37. 22:20

    that is interesting it's also interesting that it does not end in videos.testnet something that ends in videos.testnet is known as a subaccount i won't go into too much information about how tlas work or like why we're having them but it is possible to create them including on main net i made one on mainnet here as you can see just a bunch of mics i believe at the time that i made this the limit was 32 characters eventually tlas will not have this

38. 22:53

    length restriction so i could get mic not mic.near or all these mics but just straight up mic and there will be an auction for that so that's when tlas will get really interesting as at the time of this video that has not happened yet that is all we're going to really cover on on tlas that's not a very common use case the more common use case is to have sub-accounts it's the same kind of

39. 23:19

    pattern near create account likes.videos.testnet and then the master account is going to be videos.testnet so this is creating a subaccount and now this is its own standalone account likes.videos.testset is a real account here it is it's got 100 near that's because when you do this command the default initial balance is 100 near i also really love using your cla like this where you

40. 24:00

    can say in your account and then you can add the help flag and it will give you a lot of unique results on what kind of things you can do with this command down here initial balance default was 100 so that's why we have 100 for this brand new account so even though it's a sub account it is like completely separated from the other parent account you could say which is the videos.testnet so near keys likes dot videos dot

41. 24:34

    as you can see we just have one full access key so the the only one that can actually use this is the one that was just created above here right there and this can keep going this is almost like domain names so we can say near create account like.likes.videos.testnet and let's do this wrong the first way so master account videos.testnet no that's not possible it can't be created by that one it always has to be

42. 25:15

    from the subaccount that's the immediate parent so if we say the master account is likes.videos.testnet then we cannot do it because we do not have enough near we can't start with the default initial balance like i said so let's do this again let's show balance of six there we go so now we have likes.videos.testnetmike.likes.videos.testnet i think this is a good idea for things like games where you can have different players that have their own sub accounts that have

43. 26:00

    their own nonces so there aren't any nonce collisions so this is a very powerful way to have accounts for your dap thanks for joining and we will make more videos about this feel free to reach out to me and the team at near.chat thanks