validator

The validator binary runs the Prysm validator client and manages wallets and keys through its subcommands. For the flags most people set, see Common flags and config file.

Generated from Prysm v7.3.1. Each flag name is a permalink you can share. Press / to filter.

Filter flags

General

--minimal-config

Uses minimal config with parameters as defined in the spec.

Switches the chain parameters to the spec minimal preset (8 slots per epoch, small committees). Only useful for local devnets and tests built with the minimal preset; never use it on a public network.

booleandefault false

--e2e-config

Enables the E2E testing config, only for use within end-to-end testing.

Loads Prysm's end-to-end test chain config. It exists for Prysm's own E2E test suite; operators never need it.

booleandefault false

--verbosity=<string>

Logging verbosity. (trace, debug, info, warn, error, fatal, panic)

Global log level for the terminal (and for --log-file). debug and trace are noisy; use --log.vmodule to raise the level of a single package instead of everything.

--verbosity=debug

See also --log.vmodule, --log-format, --log-fileRead the guide

stringdefault info

--datadir=<string>

Data directory for the databases.

Directory for the validator database: slashing protection history (validator.db, or validator-client-data/ with minimal slashing protection), proposer settings saved at runtime, and the rolling debug log under logs/. The default is ~/.eth2 on Linux, ~/Library/Eth2 on macOS and %LOCALAPPDATA%\Eth2 on Windows.

This directory holds your slashing protection history. Back it up with the wallet and move it together with the keys; starting the same keys with an empty database removes the protection against double signing.

--datadir=/var/lib/ethereum/validator

See also --wallet-dir, --clear-dbRead the guide

stringdefault ~/Library/Eth2

--wallet-dir=<string>

Path to a wallet directory on-disk for Prysm validator accounts.

Location of the Prysm wallet that holds imported (direct/) or HD-derived (derived/) keys. Defaults to ~/.eth2validators/prysm-wallet-v2 on Linux (~/Library/Eth2Validators/prysm-wallet-v2 on macOS). Not needed when you sign with Web3Signer.

--wallet-dir=/var/lib/ethereum/validator/wallet

See also --wallet-password-file, --datadir, --keymanager-token-fileRead the guide

stringdefault ~/Library/Eth2Validators/prysm-wallet-v2

--wallet-password-file=<string>

Path to a plain-text, .txt file containing your wallet password.

Plain-text file whose content unlocks the wallet, so the validator can start without a prompt (required for services). A trailing newline is ignored. If the flag is not set, Prysm uses walletpassword.txt inside --wallet-dir when that file exists and has 0600 permissions.

Restrict the file to the user that runs the validator (chmod 600). It is ignored, with a warning, when --validators-external-signer-url is set.

--wallet-password-file=/var/lib/ethereum/validator/wallet-password.txt

See also --wallet-dirRead the guide

string

--clear-db

Prompt for clearing any previously stored data at the data directory.

Asks for confirmation, then deletes the validator database in --datadir before starting. That database is your slashing protection history.

Deleting slashing protection history removes the last safeguard against signing conflicting messages. Export it first with validator slashing-protection-history export if there is any chance you need it.

See also --force-clear-db, --datadirRead the guide

booleandefault false

--force-clear-db

Clears any previously stored data at the data directory.

Deletes the validator database (slashing protection history) without asking. Same effect as --clear-db without the prompt.

Never leave this flag in a service file: every restart would wipe your slashing protection history.

See also --clear-db, --datadirRead the guide

booleandefault false

--enable-tracing

Enables OpenTelemetry tracing.

Exports OpenTelemetry traces of validator duties and beacon node calls to --tracing-endpoint. Useful for debugging latency; off by default because it costs CPU and network.

See also --tracing-endpoint, --tracing-process-name, --trace-sample-fractionRead the guide

booleandefault false

--tracing-process-name=<string>

Name to apply to tracing tag `process_name`.

Value of the process_name tag attached to every exported trace. Set it when several validator clients send traces to the same collector so you can tell them apart.

--tracing-process-name=validator-1

See also --enable-tracing

string

--tracing-endpoint=<string>

OTLP/HTTP endpoint that traces are exported to (e.g. an OpenTelemetry Collector or a Tempo receiver).

OTLP/HTTP URL that receives traces when --enable-tracing is set, for example an OpenTelemetry Collector or Grafana Tempo receiver.

--tracing-endpoint=http://127.0.0.1:4318/v1/traces

See also --enable-tracing

stringdefault http://127.0.0.1:14268/api/traces

--trace-sample-fraction=<float64>

Head-sampling ratio applied to every trace started by the process. 1.0 keeps all traces.

Fraction of traces kept, from 0 to 1. The default 0.2 keeps one trace in five; use 1 while you debug a specific problem.

See also --enable-tracing

float64default 0.2

--monitoring-host=<string>

Host used for listening and responding metrics for prometheus.

Interface for the Prometheus metrics server (/metrics on --monitoring-port). Keep 127.0.0.1 unless Prometheus runs on another machine, then bind to a private interface and firewall it.

--monitoring-host=0.0.0.0

See also --monitoring-port, --disable-monitoringRead the guide

stringdefault 127.0.0.1

--monitoring-port=<int>

Port used to listening and respond metrics for Prometheus.

Port of the validator client's Prometheus endpoint. The beacon node uses 8080 by default, so the validator's 8081 does not clash on a single machine.

curl -s http://127.0.0.1:8081/metrics | head

See also --monitoring-host, --disable-monitoring, --disable-account-metricsRead the guide

intdefault 8081

--disable-monitoring

Disables monitoring service.

Does not start the Prometheus metrics server at all. The validator logs Prometheus service disabled at startup.

See also --monitoring-port

booleandefault false

--disable-log-colors

Disable color formatting for terminal logs.

Removes ANSI color codes from text logs. Use it when logs go to a file or a log collector that shows the escape codes as garbage.

See also --log-format

booleandefault false

--log-format=<string>

Specifies log formatting. Supports: text, json, fluentd, journald.

text (default, human-readable), json (one JSON object per line, for log pipelines), fluentd, or journald (writes straight to the systemd journal). Any other value stops startup with unknown log format.

--log-format=json

See also --log-file, --verbosityRead the guide

stringdefault text

--log-file=<string>

Specifies log file name, relative or absolute.

Also appends logs to this file (created if missing), in addition to the terminal. Prysm does not rotate it; use logrotate or journald for long-running services.

--log-file=/var/log/prysm/validator.log

See also --log-format, --disable-ephemeral-log-fileRead the guide

string

--config-file=<string>

Filepath to a yaml file with flag values.

YAML file whose keys are flag names without dashes, for example wallet-dir: /path. A flag passed on the command line wins over the same key in the file.

wallet-dir: /var/lib/ethereum/validator/wallet
suggested-fee-recipient: "0x0000000000000000000000000000000000000000"
hoodi: true

See also --chain-config-file

string

--chain-config-file=<string>

Path to a YAML file with chain config values.

Loads chain parameters (fork epochs, genesis settings, preset overrides) from a YAML file in the consensus-specs config.yaml format. Needed only for custom devnets; the beacon node must use the same file.

--chain-config-file=/path/to/devnet/config.yaml

See also --config-file

string

--grpc-max-msg-size=<int>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Integer to define max receive message call size (in bytes). If serving a public gRPC server, set this to a more reasonable size to avoid resource exhaustion from large messages. Validators with as many as 10000 keys can be run with a max message size of less than 50Mb. The default here is set to a very high value for local users.

Largest gRPC response, in bytes, the validator accepts from the beacon node. The default (2 GiB) is effectively unlimited; the only reason to lower it is to limit memory use when talking to an untrusted node.

See also --beacon-rpc-provider

intdefault 2147483647

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Accepts the Prysm terms of use without the interactive prompt. After the first accepted run Prysm writes a tosaccepted file in --datadir and stops asking.

Read the guide

booleandefault false

--api-timeout=<duration>

Specifies the timeout value for API requests in seconds.

Registered on the validator for symmetry with the beacon node, where it sets the HTTP API timeout. The validator client does not read it; its calls to a beacon node REST API use a fixed 30-second timeout.

durationdefault 10s

--disable-ephemeral-log-file

Disables the creation of a debug log file that keeps 24 hours of logs.

By default the validator also writes debug-level logs to <datadir>/logs/validator.log, kept for about 24 hours (at most 250 MB), which is useful for bug reports. This flag turns that file off.

See also --log-file, --datadirRead the guide

booleandefault false

--log.vmodule=<string list>

Per-package log verbosity. packagePath=level entries separated by commas.

Overrides the log level for specific packages, as package/path=level pairs separated by commas. Package paths are those shown in the log prefix source, for example validator/client; a path also matches its subpackages. Applies to text output.

--log.vmodule=validator/client=debug,validator/keymanager=trace

See also --verbosityRead the guide

string list

Debugging and profiling

--pprof

Enables the pprof HTTP server.

Starts Go's pprof HTTP server on --pprofaddr:--pprofport so you can capture CPU, heap and goroutine profiles. Leave it off unless you are debugging.

pprof has no authentication. Keep it on localhost.

go tool pprof http://127.0.0.1:6060/debug/pprof/heap

See also --pprofaddr, --pprofport

booleandefault false

--pprofaddr=<string>

pprof HTTP server listening interface.

Interface for the pprof server. Keep the default 127.0.0.1.

See also --pprof, --pprofport

stringdefault 127.0.0.1

--pprofport=<int>

pprof HTTP server listening port.

Port for the pprof server. The beacon node uses the same default (6060), so change one of them if both run with --pprof on the same host.

See also --pprof, --pprofaddr

intdefault 6060

--memprofilerate=<int>

Turns on memory profiling with the given rate.

Sets Go's runtime.MemProfileRate: one allocation sample per this many bytes. Lower values give more detailed heap profiles at a CPU cost. Only relevant with --pprof.

See also --pprof

intdefault 524288

--blockprofilerate=<int>

Turns on block profiling with the given rate.

Sets Go's block profile rate (0 disables it). Enable it only to investigate goroutines blocked on channels or locks, together with --pprof.

See also --pprof, --mutexprofilefraction

intdefault 0

--mutexprofilefraction=<int>

Turns on mutex profiling with the given rate.

Samples 1 in N mutex contention events for the mutex profile (0 disables it). Only useful with --pprof when debugging lock contention.

See also --pprof, --blockprofilerate

intdefault 0

RPC and APIs

--tls-cert=<string>

Certificate for secure gRPC. Pass this and the tls-key flag in order to use gRPC securely.

Certificate (PEM) the validator uses to verify the beacon node's gRPC TLS certificate. Pass the same certificate the beacon node serves with its --tls-cert/--tls-key. Without this flag the gRPC connection is unencrypted, which is fine on localhost.

If the file cannot be read, the validator logs Could not get valid credentials and does not connect to the beacon node at all.

--tls-cert=/etc/prysm/beacon.crt

See also --beacon-rpc-provider

string

--beacon-rpc-provider=<string>alias --beacon-grpc

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Beacon node RPC provider endpoint.

host:port of the beacon node's gRPC API (beacon node --rpc-port, default 4000). Accepts a comma-separated list: one node is used at a time, and when it is not synced or unreachable the validator switches to the next one (checked once per slot).

Ignored once the REST API is enabled (--beacon-rest-api-provider or --enable-beacon-rest-api). A remote beacon node must listen on a reachable interface (its --rpc-host).

--beacon-rpc-provider=127.0.0.1:4000,10.0.0.2:4000

See also --beacon-rest-api-provider, --tls-cert, --grpc-headers, --max-health-checksRead the guide

stringdefault 127.0.0.1:4000

--beacon-rest-api-headers=<string>

Comma-separated list of key value pairs to pass as headers for all HTTP calls to the beacon node. To provide multiple values for the same key, specify the same key for each value. Example: --grpc-headers=key1=value1,key1=value2,key2=value3

Extra HTTP headers sent with every REST request to the beacon node, as key=value pairs separated by commas; repeat a key to send several values. Typical use: an authorization header for a beacon node behind a proxy. Malformed pairs are skipped silently.

--beacon-rest-api-headers=Authorization=Bearer <TOKEN>

See also --beacon-rest-api-provider, --grpc-headers

string

--rpc

Enables the RPC server for the validator client (without Web UI).

Starts the validator's HTTP server (HTTP only; the validator runs no gRPC server) on --http-host:--http-port, which serves the Keymanager API and Prysm's validator API, authenticated with the token in --keymanager-token-file. Without --rpc (or --web) there is no validator API at all.

See also --http-host, --http-port, --keymanager-token-file, --webRead the guide

booleandefault false

--rpc-host=<string>

Host on which the RPC server should listen.

No effect: the v7 validator client runs no gRPC server, and this flag is registered but never read. The API started by --rpc or --web is HTTP only, on --http-host.

See also --http-host, --rpc

stringdefault 127.0.0.1

--rpc-port=<int>

RPC port exposed by a validator client.

No effect: the v7 validator client runs no gRPC server, so nothing listens on this port (default 7000). The API started by --rpc or --web is HTTP only, on --http-port (default 7500).

See also --http-port, --rpc

intdefault 7000

--http-port=<int>alias --grpc-gateway-port

Port on which the HTTP server runs on.

Port of the validator HTTP server (Keymanager API, Prysm validator API and web UI) started by --rpc or --web.

curl -H "Authorization: Bearer <TOKEN>" http://127.0.0.1:7500/eth/v1/keystores

See also --rpc, --http-host, --keymanager-token-fileRead the guide

intdefault 7500

--http-host=<string>alias --grpc-gateway-host

Host on which the HTTP server runs on.

Interface the validator HTTP server listens on. Any value other than 127.0.0.1 logs a warning, because the API is plain HTTP and can import, delete and exit keys.

Never expose this port to the internet. If you must reach it remotely, use an SSH tunnel or a TLS-terminating proxy on a private network.

See also --rpc, --http-port, --http-cors-domainRead the guide

stringdefault 127.0.0.1

--grpc-retries=<uint>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Number of attempts to retry gRPC requests.

How many times a failed gRPC call to the beacon node is retried before the error is returned. Applies to gRPC only.

See also --grpc-retry-delay, --beacon-rpc-provider

uintdefault 5

--grpc-retry-delay=<duration>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Amount of time between gRPC retry requests.

Base delay between gRPC retries; Prysm uses a linear backoff, so the Nth retry waits N times this value. Accepts Go durations such as 500ms or 2s.

See also --grpc-retries

durationdefault 1s

--http-cors-domain=<string>alias --grpc-gateway-corsdomain

Comma separated list of domains from which to accept cross origin requests (browser enforced).

Origins a browser may call the validator HTTP API from. The default covers the Prysm web UI on common local ports. Only relevant for browser-based tools; it is not access control for scripts.

--http-cors-domain=http://localhost:7500

See also --http-host, --web

stringdefault http://localhost:7500,http://127.0.0.1:7500,http://0.0.0.0:7500,http://localhost:4242,http://127.0.0.1:4242,http://localhost:4200,http://0.0.0.0:4242,http://127.0.0.1:4200,http://0.0.0.0:4200,http://localhost:3000,http://0.0.0.0:3000,http://127.0.0.1:3000

--grpc-headers=<string>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Comma separated list of key value pairs to pass as gRPC headers for all gRPC calls. Example: --grpc-headers=key=value

Extra metadata sent with every gRPC call to the beacon node, as key=value pairs separated by commas. Use it when a proxy in front of the beacon node needs an authorization header.

--grpc-headers=authorization=Bearer <TOKEN>

See also --beacon-rpc-provider, --beacon-rest-api-headers

string

--beacon-rest-api-provider=<string>alias --beacon-rest

Beacon node REST API provider endpoint. Setting this implicitly enables the beacon REST API (no need for --enable-beacon-rest-api). Use a comma-separated list to connect to several beacon nodes: the validator client listens to the event stream of every node and queries all of them, keeping the best suited response.

URL of the beacon node's REST API (beacon node --http-port, default 3500). Setting this flag switches the validator from gRPC to REST. A comma-separated list connects to every node at once: writes go to all of them, time-critical reads are raced and the answer matching the newest known head wins.

Include the scheme (http:// or https://). A remote beacon node must listen on a reachable interface (its --http-host).

--beacon-rest-api-provider=http://127.0.0.1:3500,http://10.0.0.2:3500

See also --enable-beacon-rest-api, --beacon-rest-api-headers, --beacon-rpc-provider, --max-health-checksRead the guide

stringdefault http://127.0.0.1:3500

Proposer settings

--proposer-settings-file=<string>

Sets path to a YAML or JSON file containing validator settings used when proposing blocks such as fee recipient and gas limit. File format found in docs.

JSON or YAML file with per-validator and default proposer settings: fee recipient, gas limit, graffiti and builder options. Read once at startup and saved to the validator database. Cannot be combined with --proposer-settings-url.

When the file has a proposer_config section, it replaces the per-key settings saved in the database, including fee recipients you changed through the Keymanager API. Prysm logs a warning listing the replaced keys.

--proposer-settings-file=/etc/prysm/proposer-settings.yaml

See also --proposer-settings-url, --suggested-fee-recipient, --enable-builderRead the guide

string

--proposer-settings-url=<string>

Sets URL to a REST endpoint containing validator settings used when proposing blocks such as fee recipient and gas limit. File format found in docs

Same as --proposer-settings-file, but fetched from a URL with an HTTP GET at startup. The response must be 200 with a JSON body (YAML is not accepted here), and unknown fields are rejected. The URL is not polled again.

--proposer-settings-url=https://config.internal.example/proposer-settings.json

See also --proposer-settings-file, --suggested-fee-recipientRead the guide

string

--suggested-fee-recipient=<string>

Sets the default address that receives the fees of blocks proposed by all validators. A builder integrated through the Builder API may pay a different address as payment for the blocks it builds. Per-key settings from a proposer settings file, URL, or the keymanager API take precedence.

Default execution-layer address that receives priority fees and MEV payments for every validator in this client. Per-validator values from a proposer settings file or the Keymanager API take precedence. The default is the burn address, so set it.

Use an address you control. Prysm warns if the address is not checksummed (mixed case) and logs Fee recipient is burn address during builder registration if it was never set.

--suggested-fee-recipient=<YOUR_ETH_ADDRESS>

See also --proposer-settings-file, --enable-builderRead the guide

stringdefault 0x0000000000000000000000000000000000000000

--enable-builderalias --enable-validator-registration

Enables builder validator registration APIs for the validator client to update settings such as fee recipient and gas limit. This flag is not required if using proposer settings config file.

Turns on builder (MEV-Boost) registration for all validators: every epoch the validator signs a registration with its fee recipient and gas limit and sends it to the beacon node, which forwards it to the relays. The beacon node also needs --http-mev-relay. Equivalent to builder.enabled: true in default_config of a proposer settings file.

Registrations are only sent for validators that have a fee recipient. From the Gloas fork on, this flag has no effect; builders are configured with version 2 proposer settings.

See also --suggested-fee-recipient, --suggested-gas-limit, --proposer-settings-file, --validators-registration-batch-sizeRead the guide

booleandefault false

--suggested-gas-limit=<string>

Sets the default gas limit for all validators: registered with builders before Gloas and signed into proposer preferences from Gloas onward, where it overrides the network gas limit schedule. Remove it to follow the schedule. Per-key settings from a proposer settings file, URL, or the keymanager API take precedence.

Default gas limit (in gas units) for all validators. Before the Gloas fork, it's sent to builders with the registrations. From Gloas on, it's signed into the proposer preferences and overrides the network gas limit schedule; remove it to follow the schedule. Per-key gas limits from a proposer settings file, a proposer settings URL or the Keymanager API take precedence. It doesn't change the gas limit of locally built blocks before Gloas, which your execution client decides.

0 is replaced with the default. Prysm warns if the value is below 10% or above 150% of the default, and, on a network with Gloas scheduled, at startup and when the value exceeds the highest scheduled gas limit.

--suggested-gas-limit=60000000

See also --enable-builder, --proposer-settings-fileRead the guide

stringdefault 60000000

--builder-urls=<string list>

Comma-separated URLs of Gloas builders to request execution payload bids from, for all validators. Auth data agreed with a builder may be appended as a hex fragment (https://builder.example#0x0123); otherwise the URL's UTF-8 bytes are used. Before Gloas a non-empty list also enables builder validator registration, like --enable-builder; set the gas limit with --suggested-gas-limit. Per-key settings from a proposer settings file, URL, or the keymanager API take precedence.

From the Gloas fork on, comma-separated URLs of the builders to ask for execution payload bids, for all validators. Append the auth data agreed with a builder as a hex fragment (https://builder.example#0x0123); without it, Prysm derives it from the URL. Before Gloas, a non-empty list also turns on builder registration, like --enable-builder. Per-key settings from a proposer settings file, a proposer settings URL or the Keymanager API take precedence. The setting applies to this run only: restarting without the flag doesn't keep it.

--builder-urls=https://builder.example

See also --builder-min-bid, --builder-boost-factor, --builder-max-execution-payment, --proposer-settings-file

string list

--builder-min-bid=<uint64>

Minimum total payment in Gwei a Gloas builder bid must offer to be considered, for all validators: the bid value plus its execution payment up to --builder-max-execution-payment. Only used from Gloas onward. Per-key settings from a proposer settings file, URL, or the keymanager API take precedence.

From the Gloas fork on, the minimum total payment, in Gwei, a builder bid must offer to be considered, for all validators: the bid value plus its execution payment, counted up to --builder-max-execution-payment. Per-key settings take precedence.

--builder-min-bid=1000000

See also --builder-urls, --builder-boost-factor, --builder-max-execution-payment, --proposer-settings-file

uint64default 0

--builder-boost-factor=<uint64>

Percentage applied to Gloas builder bid values when comparing them with a locally built payload, for all validators. 100 is neutral, below 100 favors the local payload, 0 always uses it. Only used from Gloas onward. Per-key settings from a proposer settings file, URL, or the keymanager API take precedence.

From the Gloas fork on, the percentage applied to builder bid values when comparing them with the locally built payload, for all validators. 100 (default) compares them as they are, a lower value favors the local payload, and 0 always uses it. Per-key settings take precedence.

--builder-boost-factor=90

See also --builder-urls, --builder-min-bid, --builder-max-execution-payment, --proposer-settings-file

uint64default 100

--builder-max-execution-payment=<uint64>

Maximum execution layer payment in Gwei counted toward a Gloas builder bid, for all validators. 0 counts only the collateral-backed bid value; payments above that rest on the builder's promise to pay. Only used from Gloas onward. Per-key settings from a proposer settings file, URL, or the keymanager API take precedence.

From the Gloas fork on, the maximum execution layer payment, in Gwei, counted toward a builder bid, for all validators. 0 (default) counts only the bid value backed by the builder's collateral; anything above rests on the builder's promise to pay. A builder with no maximum set gets a startup warning that its bids may lose to the local payload. Per-key settings take precedence.

--builder-max-execution-payment=1000000

See also --builder-urls, --builder-min-bid, --builder-boost-factor, --proposer-settings-file

uint64default 0

--validators-registration-batch-size=<int>

Sets the maximum size for one batch of validator registrations. Use a non-positive value to disable batching.

Number of builder registrations sent to the beacon node per request. Lower it if a large validator set causes registration requests to time out; 0 or a negative value sends everything in one request.

See also --enable-builder

intdefault 200

--stateless

Enables stateless block production from Gloas onward: the validator requests the block and execution payload envelope together and republishes the envelope itself. Works over both the gRPC and REST validator clients. Forced on when several beacon nodes are configured, since only the node that built a block can reveal its payload.

Only matters from the Gloas fork on: the validator fetches the block and its execution payload envelope in one call and publishes the envelope itself. Prysm turns it on automatically when you configure multiple beacon nodes, because only the node that built a block can reveal its payload.

See also --beacon-rest-api-provider, --beacon-rpc-providerRead the guide

booleandefault false

--graffiti=<string>

String to include in proposed blocks.

Text (up to 32 bytes) written into every block this validator client proposes. Prefix with hex: to pass raw bytes. Graffiti set in proposer settings or through the Keymanager API takes precedence over this flag.

--graffiti="my node"

See also --graffiti-fileRead the guide

string

--graffiti-file=<string>

Path to a YAML file with graffiti values.

YAML file with default, ordered, random and specific (by validator index) graffiti. Used only when neither proposer settings nor --graffiti provide one. A file that fails to parse is logged as a warning and ignored.

default: "my node"
specific:
  12345: "validator 12345"

See also --graffitiRead the guide

string

Remote signer (Web3Signer)

--validators-external-signer-url=<string>alias --remote-signer-url

URL for consensys' web3signer software to use with the Prysm validator client.

Base URL of a Web3Signer instance. Setting it switches the validator to remote signing: no Prysm wallet is opened, and every signature is requested from Web3Signer's /api/v1/eth2/sign endpoint. You must also say which keys to use.

Slashing protection still runs in the validator client, and Web3Signer can keep its own. Never let two validator clients sign with the same keys through one Web3Signer.

--validators-external-signer-url=http://127.0.0.1:9000

See also --validators-external-signer-public-keys, --validators-external-signer-key-fileRead the guide

string

--validators-external-signer-public-keys=<string list>alias --remote-signer-keys

Comma separated list of public keys OR an external url endpoint for the validator to retrieve public keys from for usage with web3signer.

Which Web3Signer keys this validator client uses: either a comma-separated list of public keys, or a single URL returning a JSON array of keys (usually <web3signer>/api/v1/eth2/publicKeys, which lists every key Web3Signer holds).

The URL form validates every key Web3Signer serves. If several validator clients share one Web3Signer, give each an explicit key list instead.

--validators-external-signer-public-keys=0x<PUBKEY_1>,0x<PUBKEY_2>

See also --validators-external-signer-url, --validators-external-signer-key-file, --validators-external-signer-poll-intervalRead the guide

string list

--validators-external-signer-key-file=<string>alias --remote-signer-keys-file

A file path used to load remote public validator keys and persist them through restarts.

Text file with one public key per line (with or without 0x). Keys in it are validated in addition to those from --validators-external-signer-public-keys; the file is watched and reloaded when it changes. Keymanager API calls to /eth/v1/remotekeys write to this file, so they survive restarts.

The file must already exist (create an empty one); otherwise startup fails with no file exists in remote signer key file path. Its directory must be writable for API imports and deletions.

--validators-external-signer-key-file=/var/lib/ethereum/validator/remote-keys.txt

See also --validators-external-signer-url, --validators-external-signer-public-keysRead the guide

string

--validators-external-signer-poll-interval=<duration>alias --remote-signer-poll-interval

Interval to poll the external signer public-keys URL for added or removed validators (e.g. 30s, 5m). Zero or negative disables polling. A failed or empty response keeps the current keys, so removing every key from the URL will not stop validating.

Re-fetches the public keys URL from --validators-external-signer-public-keys on this interval and starts or stops validating keys as they appear or disappear. With polling on, the validator also starts when the URL is temporarily unreachable.

Has no effect with a static key list. An error or an empty response keeps the current keys, so emptying Web3Signer does not stop validation; restart or remove keys through the API instead.

--validators-external-signer-poll-interval=1m

See also --validators-external-signer-public-keysRead the guide

durationdefault 0s

Miscellaneous

--disable-rewards-penalties-logging

Disables reward/penalty logging during cluster deployment.

Stops the per-epoch log lines that summarize each validator's balance change and attestation performance. Useful for clients with many keys whose logs are dominated by these lines.

See also --disable-account-metrics

booleandefault false

--disable-account-metrics

Disables prometheus metrics for validator accounts. Operators with high volumes of validating keys may wish to disable granular prometheus metrics as it increases the data cardinality.

Drops the per-validator Prometheus metrics (labeled by public key). With thousands of keys these labels make metrics large and slow to scrape; aggregate metrics remain.

See also --monitoring-port, --disable-rewards-penalties-loggingRead the guide

booleandefault false

--distributed

To enable the use of prysm validator client in Distributed Validator Cluster

Runs the validator as part of a distributed validator cluster (DVT middleware such as Obol Charon sits between the validator and the beacon node). Aggregation selection proofs are then exchanged through the middleware. Requires the REST API.

Startup fails with --distributed requires --enable-beacon-rest-api unless the REST API is enabled (setting --beacon-rest-api-provider also counts).

See also --beacon-rest-api-provider, --enable-beacon-rest-api

booleandefault false

--keymanager-token-file=<string>alias --validator-api-bearer-file

Path to auth token file used for validator apis.

File holding the bearer token for the validator HTTP API: a single line with a 256-bit hex string. Created on first start with --rpc if missing. Send it as Authorization: Bearer <TOKEN>. The file is watched, so you can rotate the token without a restart.

Without this flag, the token is auth-token in the wallet directory set by --wallet-dir.

--keymanager-token-file=/var/lib/ethereum/validator/auth-token

See also --rpc, --http-port, --wallet-dirRead the guide

stringdefault ~/Library/Eth2Validators/prysm-wallet-v2/auth-token

--disable-duties-polling

Disables polling of duties on dependent root changes.

Meant to stop the validator re-fetching duties when the dependent root changes. In this release the flag is registered but not passed to the validator service, so duties polling stays on regardless.

booleandefault false

--max-health-checks=<int>

Maximum number of consecutive failed health checks before exiting. A health check fails when no connected beacon node is ready. Set to 0 or a negative number for indefinite checks.

The validator client checks once per slot that at least one configured beacon node is ready (/eth/v1/node/health returns 200 for REST). After this many consecutive failures the validator client stops: 1 stops on the first failed check. 0 (default) keeps checking forever.

--max-health-checks=10

See also --beacon-rpc-provider, --beacon-rest-api-provider

intdefault 0

Feature flags

--write-wallet-password-on-web-onboarding

(Danger): Writes the wallet password to the wallet directory on completing Prysm web onboarding. We recommend against this flag unless you are an advanced user.

When you create a wallet through the Prysm web UI, also saves the wallet password to a file in the wallet directory so later restarts do not ask for it.

Anyone who can read the wallet directory then has both the keys and their password.

See also --web, --wallet-password-file

booleandefault false

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses the Sepolia testnet config. Sepolia has a permissioned validator set, so it is mostly for application testing, not staking practice. Only one network flag can be set.

See also --hoodi, --mainnetRead the guide

booleandefault false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses the Hoodi testnet config, the recommended network for practicing validator operations. The beacon node must run on the same network. Only one network flag can be set.

See also --mainnet, --sepoliaRead the guide

booleandefault false

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses Ethereum mainnet parameters. This is the default, so the flag only makes the choice explicit in service files. Only one network flag can be set.

See also --hoodi, --sepoliaRead the guide

booleandefault true

--dynamic-key-reload-debounce-interval=<duration>

(Advanced): Specifies the time duration the validator waits to reload new keys if they have changed on disk. Can be any type of duration such as 1.5s, 1000ms, 1m.

With a local wallet, the validator watches the wallet keystore file and reloads keys when it changes (for example after accounts import in another terminal). This is how long it waits for writes to settle before reloading. Accepts Go durations.

--dynamic-key-reload-debounce-interval=5s

See also --wallet-dir

durationdefault 1s

--disable-attest-timely

Disable validator attesting timely after current block processes. See #8185 for more details.

By default the validator attests as soon as the block for the slot is processed, instead of always waiting until the attestation deadline. This flag restores the old behavior of waiting for the deadline.

booleandefault false

--disable-duty-aware-shutdown

Stop the validator client immediately on SIGINT/SIGTERM, instead of waiting for the moment in the slot where a restart would not miss any rewarded duty.

By default, when you stop the validator client (SIGINT or SIGTERM), it first waits until the current slot's attestations, sync committee messages and block proposals are done, and, if too little of the slot is left to restart in time, also the next slot's. It waits at most 8 seconds, and a second stop signal stops it at once. This flag stops it immediately instead.

Read the guide

booleandefault false

--enable-slashing-protection-history-pruning

Enables the pruning of the validator client's slashing protection database.

At startup, deletes attestation records older than the weak subjectivity period from the (complete) slashing protection database. Keeps validator.db from growing forever. Protection for recent epochs is unaffected.

See also --datadir, --enable-minimal-slashing-protectionRead the guide

booleandefault false

--enable-minimal-slashing-protection

(Experimental): Enables the minimal slashing protection. See EIP-3076 for more details.

Stores only the minimum EIP-3076 needs (highest source/target epochs and highest proposed slot per key) in <datadir>/validator-client-data/ instead of the full history in validator.db. Smaller and faster, especially with many keys. An existing complete database keeps being used until you convert it with validator db convert-complete-to-minimal.

Starting without this flag when only a minimal database exists converts it back to a complete one. If both databases exist, startup fails; delete one.

See also --datadir, --enable-slashing-protection-history-pruningRead the guide

booleandefault false

--enable-doppelganger

Enables the validator to perform a doppelganger check. This is not a foolproof method to find duplicate instances in the network. Your validator will still be vulnerable if it is being run in unsafe configurations.

At startup, asks the beacon node whether any of your keys were live on chain over roughly the last 2-3 epochs, and refuses to start (Duplicate instances exists in the network for validator keys) if so. Keys added while running are held out of duties for at least 2 epochs, until they pass the same check.

Only detects a duplicate that is actively attesting. Keys whose local history shows a very recent attestation skip the check, and an instance that is offline at that moment is not detected. It does not replace shutting down the old machine.

See also --datadir

booleandefault false

--enable-beacon-rest-apialias --enable-rest

(Experimental): Enables the beacon REST API when querying a beacon node. Optional: also enabled implicitly when --beacon-rest-api-provider is set.

Talks to the beacon node over its REST API (--beacon-rest-api-provider, default http://127.0.0.1:3500) instead of gRPC. Setting --beacon-rest-api-provider enables this implicitly, so the flag is only needed when you rely on the default URL.

See also --beacon-rest-api-provider, --beacon-rpc-provider

booleandefault false

--disable-duties-v2

Forces use of get duties endpoint instead of v2.

Makes the gRPC client use the older get-duties endpoint instead of the v2 one. A compatibility switch for beacon nodes that lack the v2 endpoint; it does nothing with the REST API.

See also --beacon-rpc-provider

booleandefault false

--web

(Work in progress): Enables the web portal for the validator client.

Serves the Prysm web UI from the validator HTTP server (implies the API from --rpc). At startup the validator logs an /initialize?token=... link to open in a browser.

The web UI does not fully support Web3Signer; Prysm warns if you combine them.

See also --rpc, --http-port, --keymanager-token-fileRead the guide

booleandefault false

deprecated

--holesky

Runs Prysm configured for the Holesky test network.

Uses the Holesky testnet config. Deprecated: the Holesky testnet has been shut down. Use --hoodi for test setups. Only one network flag can be set.

See also --hoodi, --sepolia, --mainnetRead the guide

booleandefault false

Subcommands

validator wallet create

creates a new wallet with a desired type of keymanager: either on-disk (imported), derived, or using remote credentials

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Wallet to operate on. Defaults to ~/.eth2validators/prysm-wallet-v2 on Linux. The command fails if a wallet already exists there.

See also --wallet-dir

default ~/Library/Eth2Validators/prysm-wallet-v2

--keymanager-kind=<altsrc.string>

Kind of keymanager, either imported, derived, or remote, specified during wallet creation.

imported (also local or direct) for a wallet you import EIP-2335 keystores into, or derived for an HD wallet that generates a new mnemonic on this machine. web3signer is rejected: remote signing needs no wallet. Without the flag you are prompted.

Prefer imported with keys generated offline. A derived wallet displays a new mnemonic on the validator machine.

validator wallet create --keymanager-kind=imported --wallet-dir=<WALLET_DIR> --wallet-password-file=<PASSWORD_FILE>

Read the guide

--remote-signer-crt-path=<altsrc.string>

/path/to/client.crt for establishing a secure, TLS gRPC connection to a remote signer server.

Left over from the removed gRPC remote-signer wallet type. The command does not read it; for remote signing use Web3Signer with --validators-external-signer-url instead.

See also --validators-external-signer-url

--remote-signer-key-path=<altsrc.string>

/path/to/client.key for establishing a secure, TLS gRPC connection to a remote signer server.

Left over from the removed gRPC remote-signer wallet type. The command does not read it; for remote signing use Web3Signer with --validators-external-signer-url instead.

See also --validators-external-signer-url

--remote-signer-ca-crt-path=<altsrc.string>

/path/to/ca.crt for establishing a secure, TLS gRPC connection to a remote signer server.

Left over from the removed gRPC remote-signer wallet type. The command does not read it; for remote signing use Web3Signer with --validators-external-signer-url instead.

See also --validators-external-signer-url

--wallet-password-file=<altsrc.string>

Path to a plain-text, .txt file containing your wallet password.

File containing the wallet password, so the command does not prompt for it. A trailing newline is ignored. The password must be at least 8 characters.

See also --wallet-password-file

--mnemonic-25th-word-file=<altsrc.string>

(Advanced) Path to a plain-text, `.txt` file containing a 25th word passphrase for your mnemonic for HD wallets.

File containing the optional BIP-39 passphrase ("25th word") of the mnemonic. The same mnemonic with a different passphrase derives completely different keys.

If you lose the passphrase you cannot recover the keys from the mnemonic alone.

--skip-mnemonic-25th-word-check=<altsrc.string>

Allows for skipping the check for a mnemonic 25th word passphrase for HD wallets.

Skips the "do you use a 25th word?" prompt, for non-interactive runs. Any value works; the flag only has to be present.

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator wallet recover

uses a derived wallet seed recovery phase to recreate an existing HD wallet

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Wallet to operate on. Defaults to ~/.eth2validators/prysm-wallet-v2 on Linux. The recovered HD wallet is written here.

See also --wallet-dir

default ~/Library/Eth2Validators/prysm-wallet-v2

--mnemonic-file=<altsrc.string>

File to retrieve mnemonic for non-interactively passing a mnemonic phrase into wallet recover.

Plain-text file containing the mnemonic, so it does not have to be typed in. Without it you are prompted.

This puts your mnemonic on the validator machine, which is what you should avoid. Delete the file securely afterwards, or import keystores generated offline instead.

--wallet-password-file=<altsrc.string>

Path to a plain-text, .txt file containing your wallet password.

File containing the wallet password, so the command does not prompt for it. A trailing newline is ignored. This sets the password of the new wallet (at least 8 characters).

See also --wallet-password-file

--num-accounts=<altsrc.int>

Number of accounts to generate for derived wallets.

How many keys to derive from the mnemonic, starting at index 0. Set it to the number of validators you created from this mnemonic.

--num-accounts=4

default 1

--mnemonic-25th-word-file=<altsrc.string>

(Advanced) Path to a plain-text, `.txt` file containing a 25th word passphrase for your mnemonic for HD wallets.

File containing the optional BIP-39 passphrase ("25th word") of the mnemonic. The same mnemonic with a different passphrase derives completely different keys.

If you lose the passphrase you cannot recover the keys from the mnemonic alone.

--skip-mnemonic-25th-word-check=<altsrc.string>

Allows for skipping the check for a mnemonic 25th word passphrase for HD wallets.

Skips the "do you use a 25th word?" prompt, for non-interactive runs. Any value works; the flag only has to be present.

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator accounts delete

deletes the selected accounts from a users wallet.

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Wallet to operate on. Defaults to ~/.eth2validators/prysm-wallet-v2 on Linux.

See also --wallet-dir

default ~/Library/Eth2Validators/prysm-wallet-v2

--wallet-password-file=<altsrc.string>

Path to a plain-text, .txt file containing your wallet password.

File containing the wallet password, so the command does not prompt for it. A trailing newline is ignored.

See also --wallet-password-file

--delete-public-keys=<altsrc.string>

Comma separated list of public key hex strings to specify which validator accounts to delete.

Keys to remove from the wallet, as comma-separated hex public keys. Without it you choose interactively; you are asked to confirm either way.

Deleting a key does not exit the validator. It stops signing and starts losing rewards unless the key runs elsewhere, and its slashing protection history stays in --datadir.

--delete-public-keys=0x<PUBKEY_1>,0x<PUBKEY_2>

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator accounts list

Lists all validator accounts in a user's wallet directory

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Wallet to operate on. Defaults to ~/.eth2validators/prysm-wallet-v2 on Linux.

See also --wallet-dir

default ~/Library/Eth2Validators/prysm-wallet-v2

--wallet-password-file=<altsrc.string>

Path to a plain-text, .txt file containing your wallet password.

File containing the wallet password, so the command does not prompt for it. A trailing newline is ignored.

See also --wallet-password-file

--show-private-keys

Displays the private keys for validator accounts.

Prints the private key of each account next to its public key.

Anyone who sees the output can sign with your keys. Do not run it on a shared screen or in a logged session.

default false

--list-validator-indices

Lists validator indices.

Asks the beacon node for the validator index of each key and prints only the keys that have one. Needs a reachable beacon node at --beacon-rpc-provider.

default false

--beacon-rpc-provider=<altsrc.string>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Beacon node RPC provider endpoint.

gRPC host:port of a synced beacon node, used to look up validator indices. This command always uses gRPC, so the beacon node must serve it (--rpc-port, default 4000).

See also --beacon-rpc-provider

default 127.0.0.1:4000

--grpc-max-msg-size=<altsrc.int>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Integer to define max receive message call size (in bytes). If serving a public gRPC server, set this to a more reasonable size to avoid resource exhaustion from large messages. Validators with as many as 10000 keys can be run with a max message size of less than 50Mb. The default here is set to a very high value for local users.

Maximum gRPC response size in bytes. The default is effectively unlimited.

See also --grpc-max-msg-size

default 2147483647

--tls-cert=<altsrc.string>

Certificate for secure gRPC. Pass this and the tls-key flag in order to use gRPC securely.

Certificate to verify the beacon node's gRPC TLS certificate, if it serves TLS.

See also --tls-cert

--grpc-headers=<altsrc.string>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Comma separated list of key value pairs to pass as gRPC headers for all gRPC calls. Example: --grpc-headers=key=value

Extra key=value gRPC metadata, comma-separated, for example an auth header for a proxy.

See also --grpc-headers

--grpc-retries=<altsrc.uint>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Number of attempts to retry gRPC requests.

Retries for a failed gRPC call before giving up.

See also --grpc-retries

default 5

--grpc-retry-delay=<altsrc.duration>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Amount of time between gRPC retry requests.

Base delay between gRPC retries (linear backoff).

See also --grpc-retry-delay

default 1s

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator accounts backup

backup accounts into EIP-2335 compliant keystore.json files zipped into a backup.zip file at a desired output directory. Accounts to backup can also be specified programmatically via a --backup-for-public-keys flag which specifies a comma-separated list of hex string public keys

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Wallet to operate on. Defaults to ~/.eth2validators/prysm-wallet-v2 on Linux.

See also --wallet-dir

default ~/Library/Eth2Validators/prysm-wallet-v2

--wallet-password-file=<altsrc.string>

Path to a plain-text, .txt file containing your wallet password.

File containing the wallet password, so the command does not prompt for it. A trailing newline is ignored.

See also --wallet-password-file

--backup-dir=<altsrc.string>

Path to a directory where accounts will be backed up into a zip file.

Directory where backup.zip is written. The command refuses to overwrite an existing backup.zip there.

--backup-dir=/mnt/usb/prysm-backup

default ~/Library/Eth2Validators

--backup-public-keys=<altsrc.string>

Comma separated list of public key hex strings to specify which validator accounts to backup.

Keys to include, as comma-separated hex public keys. Without it you choose interactively.

--backup-password-file=<altsrc.string>

Path to a plain-text, .txt file containing the desired password for your backed up accounts.

File with the password used to encrypt the exported EIP-2335 keystores in the zip. You need it to import the backup later.

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator accounts import

imports Ethereum validator accounts stored in EIP-2335 keystore.json files from an external directory

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Wallet to operate on. Defaults to ~/.eth2validators/prysm-wallet-v2 on Linux. A new wallet is created if none exists.

See also --wallet-dir

default ~/Library/Eth2Validators/prysm-wallet-v2

--keys-dir=<altsrc.string>

Path to a directory where keystores to be imported are stored.

A keystore file, or a directory searched up to two levels deep for EIP-2335 keystores (for example validator_keys/ from the deposit CLI). Files that are not keystores, such as deposit_data-*.json, are skipped.

--keys-dir=$HOME/validator_keys

Read the guide

--wallet-password-file=<altsrc.string>

Path to a plain-text, .txt file containing your wallet password.

File containing the wallet password, so the command does not prompt for it. A trailing newline is ignored.

See also --wallet-password-file

--account-password-file=<altsrc.string>

Path to a plain-text, .txt file containing a password for a validator account.

File with the keystore password. The same password is used for every keystore in the import, so import keystores with different passwords in separate runs.

See also --wallet-password-fileRead the guide

--import-private-key-file=<altsrc.string>

Path to a plain-text, .txt file containing a hex string representation of a private key to import.

Imports one raw BLS private key (hex, with or without 0x) from a text file instead of keystores. The key is encrypted with the wallet password.

A raw private key file is unencrypted. Delete it securely after the import.

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator accounts voluntary-exit

Performs a voluntary exit on selected accounts

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Wallet that holds the keys to exit. Unlike other commands, you must pass this flag explicitly (or use Web3Signer); the default location is not assumed.

See also --wallet-dir

default ~/Library/Eth2Validators/prysm-wallet-v2

--wallet-password-file=<altsrc.string>

Path to a plain-text, .txt file containing your wallet password.

File containing the wallet password, so the command does not prompt for it. A trailing newline is ignored.

See also --wallet-password-file

--account-password-file=<altsrc.string>

Path to a plain-text, .txt file containing a password for a validator account.

Accepted for compatibility; the exit is signed with keys from the unlocked wallet, so only the wallet password is needed.

--public-keys=<altsrc.string>

Comma separated list of public key hex strings to specify on which validator accounts to perform a voluntary exit.

Validators to exit, as comma-separated hex public keys. Without it (and without --exit-all) you pick them interactively.

--public-keys=0x<PUBKEY>

Read the guide

--beacon-rpc-provider=<altsrc.string>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Beacon node RPC provider endpoint.

gRPC host:port of a synced beacon node, used to check sync status, fetch the fork and submit the exit. This command always uses gRPC, so the beacon node must serve it (--rpc-port, default 4000).

See also --beacon-rpc-provider

default 127.0.0.1:4000

--validators-external-signer-url=<altsrc.string>

URL for consensys' web3signer software to use with the Prysm validator client.

Signs the exit with Web3Signer instead of a local wallet. Pass it with --validators-external-signer-public-keys.

See also --validators-external-signer-urlRead the guide

--validators-external-signer-public-keys=<altsrc.string list>

Comma separated list of public keys OR an external url endpoint for the validator to retrieve public keys from for usage with web3signer.

Web3Signer keys available for the exit: a comma-separated list or a public keys URL. You then choose which of them to exit.

See also --validators-external-signer-public-keysRead the guide

--grpc-max-msg-size=<altsrc.int>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Integer to define max receive message call size (in bytes). If serving a public gRPC server, set this to a more reasonable size to avoid resource exhaustion from large messages. Validators with as many as 10000 keys can be run with a max message size of less than 50Mb. The default here is set to a very high value for local users.

Maximum gRPC response size in bytes. The default is effectively unlimited.

See also --grpc-max-msg-size

default 2147483647

--tls-cert=<altsrc.string>

Certificate for secure gRPC. Pass this and the tls-key flag in order to use gRPC securely.

Certificate to verify the beacon node's gRPC TLS certificate, if it serves TLS.

See also --tls-cert

--grpc-headers=<altsrc.string>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Comma separated list of key value pairs to pass as gRPC headers for all gRPC calls. Example: --grpc-headers=key=value

Extra key=value gRPC metadata, comma-separated, for example an auth header for a proxy.

See also --grpc-headers

--grpc-retries=<altsrc.uint>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Number of attempts to retry gRPC requests.

Retries for a failed gRPC call before giving up.

See also --grpc-retries

default 5

--grpc-retry-delay=<altsrc.duration>

WARNING: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.. Amount of time between gRPC retry requests.

Base delay between gRPC retries (linear backoff).

See also --grpc-retry-delay

default 1s

--exit-all

Exits all validators. This will still require the staker to confirm a userprompt for the action.

Selects every key in the wallet or remote signer. You still have to confirm unless --force-exit is also set.

Exits are irreversible. Check the key list the command prints before confirming.

default false

--force-exit

Exits without displaying the confirmation prompt.

Skips the final continue with the voluntary exit? (y/n) confirmation. Meant for scripted exits where the key list is already fixed.

Combined with --exit-all, this exits every key without any prompt.

default false

--exit-json-output-dir=<altsrc.string>

Output directory to write voluntary exits as individual unencrypted JSON files. If this flag is provided, voluntary exits will be written to the provided directory and will not be broadcasted.

Writes each signed exit to a JSON file in this directory instead of broadcasting it, so you can submit it later (for example with curl to /eth/v1/beacon/pool/voluntary_exits). Still needs a synced beacon node to sign.

A signed exit stays valid. Anyone who gets the file can broadcast it.

Read the guide

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator slashing-protection-history export

exports your validator slashing protection history into an EIP-3076 compliant JSON

--datadir=<altsrc.string>

Data directory for the databases.

Validator data directory whose database is read. Without the flag you are prompted. Stop the validator first: the database is locked while it runs.

See also --datadir

default ~/Library/Eth2

--slashing-protection-export-dir=<altsrc.string>

Allows users to specify the output directory to export their slashing protection EIP-3076 standard JSON File.

Directory where slashing_protection.json (EIP-3076 interchange format) is written. Import that file into any client before starting the same keys there.

--slashing-protection-export-dir=$HOME/backup

Read the guide

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--enable-minimal-slashing-protection

(Experimental): Enables the minimal slashing protection. See EIP-3076 for more details.

Set it if the validator uses minimal slashing protection, so the command reads validator-client-data/ instead of validator.db.

See also --enable-minimal-slashing-protection

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator slashing-protection-history import

imports a selected EIP-3076 compliant slashing protection JSON to the validator database

--datadir=<altsrc.string>

Data directory for the databases.

Validator data directory whose database is written. Without the flag you are prompted. Stop the validator first: the database is locked while it runs.

See also --datadir

default ~/Library/Eth2

--slashing-protection-json-file=<altsrc.string>

Path to an EIP-3076 compliant JSON file containing a user's slashing protection history.

EIP-3076 interchange file to import, for example exported from another client when you switch. Import it before the validator signs anything with these keys.

--slashing-protection-json-file=$HOME/backup/slashing_protection.json

Read the guide

--mainnet

Runs on Ethereum main network. This is the default and can be omitted.

Uses mainnet parameters (the default). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --mainnet

default true

--sepolia

Runs Prysm configured for the Sepolia test network.

Uses Sepolia parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --sepolia

default false

--holesky

Runs Prysm configured for the Holesky test network.

Uses Holesky parameters (network being retired). Pass the same network flag you run the validator client with; only one network flag can be set.

See also --holesky

default false

--hoodi

Runs Prysm configured for the Hoodi test network.

Uses Hoodi parameters. Pass the same network flag you run the validator client with; only one network flag can be set.

See also --hoodi

default false

--enable-minimal-slashing-protection

(Experimental): Enables the minimal slashing protection. See EIP-3076 for more details.

Set it if the validator uses minimal slashing protection, so the command writes validator-client-data/ instead of validator.db.

See also --enable-minimal-slashing-protection

default false

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false

validator db restore

restores a database from a backup file

--restore-source-file=<altsrc.string>

Filepath to the backed-up database file which will be used to restore the database

Backup of the validator database (a validator.db copy) to restore. It is copied to <restore-target-dir>/validator.db.

Read the guide

--restore-target-dir=<altsrc.string>

Target directory of the restored database

Validator data directory to restore into. If a validator.db already exists there you are asked before it is overwritten. Stop the validator first.

See also --datadir

default ~/Library/Eth2

validator db migrate up

Runs up migrations for the validator database

--datadir=<altsrc.string>

Data directory for the databases.

Validator data directory whose database schema is migrated forward. The validator runs these migrations itself at startup, so you rarely need this command.

See also --datadir

default ~/Library/Eth2

validator db migrate down

Runs down migrations for the validator database

--datadir=<altsrc.string>

Data directory for the databases.

Validator data directory whose database migrations are rolled back, for example before downgrading to a Prysm version that does not understand a newer schema. Stop the validator first.

See also --datadir

default ~/Library/Eth2

validator db convert-complete-to-minimal

Convert a complete EIP-3076 slashing protection to a minimal one

--source-data-dir=<string>

Source data directory

Data directory containing the complete slashing protection database (validator.db) to convert.

See also --enable-minimal-slashing-protection, --datadir

--target-data-dir=<string>

Target data directory

Data directory where the minimal database (validator-client-data/) is created. Start the validator with --enable-minimal-slashing-protection afterwards, and remove the complete database: the validator refuses to start when both exist.

See also --enable-minimal-slashing-protection, --datadir

validator web generate-auth-token

Generate an authentication token for the Prysm web interface

--wallet-dir=<altsrc.string>

Path to a wallet directory on-disk for Prysm validator accounts.

Only used when --keymanager-token-file is empty. Since that flag has a default, the token is normally written to the --keymanager-token-file path, not into this directory.

See also --wallet-dir, --keymanager-token-file

default ~/Library/Eth2Validators/prysm-wallet-v2

--http-host=<altsrc.string>

Host on which the HTTP server runs on.

Host used to print the web UI login link. It does not change where the validator listens.

See also --http-host

default 127.0.0.1

--http-port=<altsrc.int>

Port on which the HTTP server runs on.

Port used to print the web UI login link. It does not change where the validator listens.

See also --http-port

default 7500

--keymanager-token-file=<altsrc.string>

Path to auth token file used for validator apis.

File to write the new token to. Use the same path the running validator uses: it watches that file and picks up the new token without a restart.

See also --keymanager-token-fileRead the guide

default ~/Library/Eth2Validators/prysm-wallet-v2/auth-token

--accept-terms-of-use

Accepts Terms and Conditions (for non-interactive environments).

Skips the terms-of-use prompt, for scripts. Not needed once tosaccepted exists in --datadir.

See also --accept-terms-of-use

default false