> For the complete documentation index, see [llms.txt](https://help.multisig.ledger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.multisig.ledger.com/guides/cli-guides/configuring-a-signer.md).

# Configuring a signer

`lem` supports three signer modes: a Ledger hardware wallet over USB, which is the default and the only mode recommended for production, and two software signers reserved for testing and automation. This page covers how to pick a mode, how to inspect the resulting configuration, and the global flags that apply to every command.

### What you'll learn

* The three ways `lem` can produce signatures.
* How to pair a signer with `lem connect` and where the result is cached.
* Global flags that apply to every command.
* Security considerations for software signers.

### Signer modes

Selected at the command line for any command that produces a signature (connect, tx propose, tx sign, tx execute).

| Flag                               | Mode                                                                | When to use                        |
| ---------------------------------- | ------------------------------------------------------------------- | ---------------------------------- |
| *(none)*                           | USB Ledger hardware wallet                                          | Default. **Required for mainnet.** |
| --seed "\<mnemonic>"               | Software signer from a BIP-39 mnemonic                              | Testing, scripted demos.           |
| --salt \<string> --index \<number> | Software signer from a deterministic seed derived from salt + index | CI / non-interactive agents.       |

`--seed` is mutually exclusive with `--salt` / `--index`. The CLI rejects combined usage with `--seed cannot be combined with --salt or --index` (exit code 2).

> 🚨 **Danger:** Never use --seed or --salt/--index with a key that owns mainnet funds. Software signer flags exist for testnet and automated test environments only. For mainnet, stay on USB.

### Step-by-step

#### 1. Pair your signer

Pairing once writes the signer's address and derivation path into a local config file so that subsequent commands don't have to re-prompt the device.

**USB Ledger (default)**

```
lem connect
```

Confirm the address on the device when prompted.

**--seed (mnemonic)**

```
lem connect --seed "test test test test test test test test test test test junk"
```

The mnemonic above is the well-known Hardhat/Anvil test mnemonic. Do not use it outside of local testing.

**--salt + --index**

```
lem connect --salt ci-sepolia-2 --index 0
```

The salt + index combination is hashed into a deterministic mnemonic. Different salt values produce different signers. `--index` lets you derive multiple signers from the same salt.

#### 2. Inspect the cached configuration

```
lem config show --pretty
```

Returns the current signer address and derivation path, plus the env vars `lem` has loaded:

```
{
  "config": {
    "address": "0xYourSignerAddress",
    "derivationPath": "44'/60'/0'/0/0"
  },
  "env": {
    "RPC_NODE_SEPOLIA_URL": "https://...",
    "SAFE_TRANSACTION_SERVICE_SEPOLIA_URL": "https://..."
  }
}
```

To find the file on disk:

```
lem config path
# /Users/you/.config/les-multisig/config.json
```

The file is created with `0600` permissions in `~/.config/les-multisig/config.json`. To switch signers, just run `lem connect` again. It overwrites the file.

#### 3. Use the signer

Once `lem connect` has been run, every command that needs the signer picks it up automatically. You do not need to repeat the device flag on every command unless you want to override the cached identity for a single invocation.

```
lem tx sign --chain-id 11155111 0xYourSafeTxHash
```

If a signer has not been paired yet, commands that need one fail with exit code `3` (`CONFIG_ERROR`) and a `Run connect to initialize a signing identity` suggestion.

### Global options

These flags work on every command and can be combined with command-specific flags. See the **Command reference** for the per-command flag matrix.

| Flag          | Type   | Default | Description                                                                                                          |
| ------------- | ------ | ------- | -------------------------------------------------------------------------------------------------------------------- |
| --debug       | bool   | false   | Verbose logs to stderr (the JSON result still goes to stdout).                                                       |
| --timestamps  | bool   | false   | Prefix log lines with ISO-8601 timestamps.                                                                           |
| --pretty      | bool   | false   | Pretty-print the JSON output on stdout. Useful for humans; agents should leave it off so output is compact.          |
| --version, -v | bool   | false   | Print the CLI version and exit.                                                                                      |
| --env \<path> | string | .env    | Path to an env file to load before running.                                                                          |
| --help, -h    | bool   | false   | Display help for the current command. Works at any level (`lem --help`, `lem safe --help`, `lem tx propose --help`). |

### Tips and pitfalls

* `lem config show` does not print mnemonics. It only shows the signer address, derivation path, and known env vars. Mnemonics are never persisted.
* **Re-running** `lem connect` overwrites the cached identity. That is by design. There is no concept of "logout".
* **Env file scope.** `--env` defaults to `.env` in the current working directory. Distributed binaries can ship with sensible defaults baked in, so you usually do not need an env file for hosted Ledger services. You only need one for self-hosted endpoints.
* **Software signers and CI.** When deriving signers via `--salt + --index`, store the salt itself in a real secret manager. Anyone with the salt and index can sign.

### Next steps

* **Querying Safe data**
* **Proposing, signing & executing**