Use the xpub-from-metadata.ts script to retrieve the extended public keys (xPubs and fPubs) of your workspace from a key backup package. The script reads only the metadata.json file in the package, so you do not need to decrypt anything.
Before you begin
- You must be the workspace owner. No other role can download the key backup package.
- Install a current Node.js LTS version. We tested the script on Node.js 22.
- Download the script: xpub-from-metadata.ts.
You do not need to install tsx in advance. The npx command downloads it automatically.
Supported key types
| Key type | Output |
| MPC_ECDSA_SECP256K1, MPC_CMP_ECDSA_SECP256K1 | xPub |
| MPC_EDDSA_ED25519, MPC_CMP_EDDSA_ED25519 | fPub |
The script does not cover Non-Custodial Wallet (NCW) master keys.
Retrieve the extended public keys
- In the Fireblocks Console, go to Settings > General > Key backup.
- Download the key backup package.
- Unzip the package. The metadata.json file is at the root of the archive, next to the key share files.
- Run the script: npx tsx xpub-from-metadata.ts <path-to-metadata.json>
- Read the output. For example:
Tenant: <ID>
Key <ID> (MPC_CMP_ECDSA_SECP256K1):
xpub: xpub<string>
Key <ID> (MPC_EDDSA_ED25519):
fpub: fpub<string>
If the package contains a key type that the script does not support, the script stops with an Unknown algorithm error.
Handle the package and the output securely
The key backup package is a full workspace backup. Treat the entire package as sensitive, including metadata.json.
- Store the package according to your backup and recovery policy.
- Run the script on a trusted machine.
- Never share, upload, or email the package or any extracted files.
- Delete any extracted copies after you retrieve the output.
The script runs locally and makes no network calls. The only download is tsx, through npx.
An xPub or fPub cannot sign transactions. However, anyone who has it can derive all the addresses of your workspace and view their balances and history. Share it only with parties that need it.