nkeys

nkeys is a Rust implementation of the NATS nkeys library, which underpins identity, authentication, and authorization in the NATS ecosystem from v2 onward. It wraps Ed25519 keypairs in a friendly, human-readable, Base32-encoded format with type prefixes for the different NATS entity kinds: operators, accounts, users, servers, and clusters.

Ed25519 is fast and resistant to side-channel attacks, and nkeys is built so that only a seed needs to be stored securely, since both the public and private keys can be derived from it. The crate provides keypair generation, signing, and signature verification, letting Rust applications participate in NATS’s challenge-response authentication without ever exposing raw private keys.

What You Get

• Ed25519 keypair generation for NATS entity types (operator, account, user, server, cluster)
• Human-readable, Base32-encoded public keys and seeds with type prefixes and CRC checks
• Signing and signature verification for challenge-response authentication
• Seed-based restoration so only one secret needs to be stored to recover a full keypair

Common Use Cases

• Authenticating a Rust NATS client using nkey-based challenge-response
• Generating account and user credentials for a NATS deployment from Rust tooling
• Signing and verifying messages or tokens with Ed25519 in a NATS-compatible format
• Building services (such as wasmCloud) that use nkeys for entity identity and authorization

Under The Hood

Architecture - nkeys is a small, single-purpose crate (100% Rust, ~44KB) centered on a KeyPair type and a KeyPairType enum for the NATS entity prefixes. Key material is encoded with a Base32 scheme carrying a one- or two-byte prefix (two bytes for seeds) plus a CRC16 checksum, mirroring the Stellar-style encoding used by the reference implementation. The public API exposes generation from a type, restoration from a seed or public key, sign, and verify.

Tech Stack - Pure Rust built on the ed25519-dalek signature primitives, data-encoding for Base32, and a CRC implementation for the checksum bytes, with getrandom for secure seed generation. It has no runtime service dependencies.

Code Quality - The crate is intentionally compact with focused unit tests covering key generation, round-trip encoding, and sign/verify, run via GitHub Actions CI. Because it re-implements a well-specified format from the NATS Go library, correctness is validated against that reference behavior. It is mature and stable rather than actively evolving.

API Design - The API is minimal and hard to misuse: create or restore a KeyPair, read the encoded public key, and call sign/verify. Encoding, prefixes, and checksums are handled internally so callers never touch raw 32/64-byte buffers. Its enormous download count (45M+) reflects how broadly it is depended upon across the NATS and wasmCloud ecosystems.