Wallet management — create (local or Privy server-side), list, show, export, send, delete. Use when creating wallets, checking balances, or sending tokens.

Authentication Nansen account API calls accept a selected nansen:api browser session or conventional API key with the same permissions. NANSEN API KEY takes precedence; optional primaryEnv preserves configured key injection. Run nansen auth status for offline selection. Cached access expiry alone permits automatic renewal during an authorized task. Stop on anonymous selection, invalid state, blocked/uncertain renewal or actual auth failure; never drop a credential or fall back to anonymous x402 payment. Browser login does not grant wallet signing, privileged service identity or a persistent MCP integration key. Preserve all confirmation, signing, sanctions and geographic checks below. Browser login is enabled in production within the [documented platform scope](https://github.com/nansen ai/nansen cli/blob/main/docs/browser login.md preview platform scope). Wallet Auth Setup Use a selected nansen:api browser session or conventional API key for Nansen account API calls. Agents should inject NANSEN API KEY through their environment or secret manager and use commands directly; no login is needed to persist it. Human terminal users can use explicit nansen login human for legacy key setup. With an already injected environment key, that explicit mode saves it without prompting and requires the native auth lock binding. Plain nansen login instead requests fresh browser approval. It does not save an environment key or grant wallet signing/RPC authority. Wallet custody and provider credentials below remain separate. Wallet Providers The CLI supports two wallet providers: Local (default) Privy (server side) Key storage Encrypted on disk Server side via Privy API Password required Yes (min 12 chars) No Export private keys Yes ( wallet export ) No — keys are managed by Privy Best for Human users, manual trading Agents, automated workflows Flag provider local (default) provider privy Required env vars NANSEN WALLET PASSWORD PRIVY APP ID + PRIVY APP SECRET Privy Wallet Creation Privy wallets are server side wallets managed by the Privy API. No password is needed — keys never touch the local machine. Prerequisites The following environment variables must be set: Var Purpose PRIVY APP ID Privy application ID PRIVY APP SECRET Privy application secret Create a Privy wallet Critical rules for agents (Privy) No password needed — Privy manages keys server side Cannot export keys — wallet export only works for local wallets All other operations ( list , show , send , delete , default ) work identically for both providers Local Wallet Creation (Two Step Agent Flow) This section covers local wallet creation. For Privy server side wallets, see the [Privy Wallet Creation]( privy wallet creation) section above — no password is needed. Wallet creation requires a password from the human user . The agent must NOT generate or store the password itself. Step 1 (Agent → Human): Ask the user to provide a wallet password (minimum 12 characters). Step 2 (Agent executes): Run the create command with the password the user gave you. After creation, the CLI automatically saves the password: OS keychain (macOS Keychain, Linux secret tool, Windows Credential Manager) — secure, preferred ~/.nansen/wallets/.credentials file — insecure fallback when no keychain is available (e.g. containers, CI) All future wallet operations retrieve the password automatically — no env var or human input needed. If the .credentials file fallback is used, the CLI prints a warning on every operation. To migrate to secure storage later, run nansen wallet secure . Password resolution order (automatic) 1. NANSEN WALLET PASSWORD env var (if set) 2. OS keychain (saved automatically on wallet create) 3. ~/.nansen/wallets/.credentials file (insecure fallback, with warning) 4. Structured JSON error with instructions (if none available) Critical rules for agents NEVER generate a password yourself — always ask the human user NEVER store the password in files, memory, logs, or conversation history NEVER use human flag — that enables interactive prompts which agents cannot handle After wallet creation, you do NOT need the password for future operations — the keychain handles it If you get a PASSWORD REQUIRED error, ask the user to provide their password again Create Privy (server side, no password) Requires PRIVY APP ID + PRIVY APP SECRET env vars. No password needed. Local (encrypted on disk, password required) List & Show Send Export & Delete Prefer file over reveal : plaintext on stdout ends up in terminal scrollback, shell logs, and agent transcripts. Forget Password Migrate to Secure Storage For detailed migration steps (from ~/.nansen/.env , .credentials , or env var only setups), see the nansen wallet migration skill. Flags Flag Purpose to Recipient address amount Amount to send chain evm or solana max Send entire balance dry run Preview without broadcasting provider Wallet provider: local (default, encrypted on disk) or privy (server side via Privy API) reveal Export only: print private keys in plaintext to stdout (required acknowledgement) file Export only: write private keys to this path (created 0600, refuses to overwrite) human Enable interactive prompts (human terminal use only — agents must NOT use this) unsafe no password Skip encryption (keys stored in plaintext — NOT recommended) Environment Variables Var Purpose NANSEN WALLET PASSWORD Wallet encryption password — only needed for initial wallet create . After that, the OS keychain handles it. NANSEN API KEY API key (can also be saved via nansen login human ) PRIVY APP ID Privy application ID (required for provider privy ) PRIVY APP SECRET Privy application secret (required for provider privy ) NANSEN WALLET PROVIDER Default provider for wallet create — local or privy NANSEN EVM RPC Custom EVM RPC endpoint NANSEN SOLANA RPC Custom Solana RPC endpoint

nansen-wallet-manager