According to the EOSJS readme:

Using the JsSignatureProvider in the browser is not secure and should only be used for development purposes. Use a secure vault outside of the context of the webpage to ensure security when signing transactions in production

const defaultPrivateKey =
"5JtUScZK2XEp3g9gh7F8bwtPTRAkASmNrrftmx4AxDKD5K4zDnr"; // bob const
signatureProvider = new JsSignatureProvider([defaultPrivateKey]); 

According to this description, JsSignatureProvider is not safe to use in combination with .env variables. What is the safe way to programmatically send EOSIO tokens using EOSJS?

2 Answers 2


transact() with the flag sign: false returns serializedTransaction binary. You can sign it with independant and safer way you make. For example, make separated signing server which accepts binary and returns it with signature, but not possible to access from outside of your private network.


Check out this article about eosjs and scatter, I think that it has good explanation about signing transactions without exposing your keys using scatter. To be honest, I have never used it but I am planning to.


  • Maybe you misunderstood. Programmatically means to do things using code, not an user interface.
    – marijn
    Jun 10, 2019 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.