Configuring a signer

lem supports three signer modes: a Ledger hardware wallet over USB, which is the default and the only mode recommended for production, and two software signers reserved for testing and automation. This page covers how to pick a mode, how to inspect the resulting configuration, and the global flags that apply to every command.

What you'll learn

• The three ways lem can produce signatures.

• How to pair a signer with lem connect and where the result is cached.

• Global flags that apply to every command.

• Security considerations for software signers.

Signer modes

Selected at the command line for any command that produces a signature (connect, tx propose, tx sign, tx execute).

Flag	Mode	When to use
(none)	USB Ledger hardware wallet	Default. Required for mainnet.
--seed "<mnemonic>"	Software signer from a BIP-39 mnemonic	Testing, scripted demos.
--salt <string> --index <number>	Software signer from a deterministic seed derived from salt + index	CI / non-interactive agents.

--seed is mutually exclusive with --salt / --index. The CLI rejects combined usage with --seed cannot be combined with --salt or --index (exit code 2).

🚨 Danger: Never use --seed or --salt/--index with a key that owns mainnet funds. Software signer flags exist for testnet and automated test environments only. For mainnet, stay on USB.

Step-by-step

1. Pair your signer

Pairing once writes the signer's address and derivation path into a local config file so that subsequent commands don't have to re-prompt the device.

USB Ledger (default)

lem connect

Confirm the address on the device when prompted.

--seed (mnemonic)

lem connect --seed "test test test test test test test test test test test junk"

The mnemonic above is the well-known Hardhat/Anvil test mnemonic. Do not use it outside of local testing.

--salt + --index

lem connect --salt ci-sepolia-2 --index 0

The salt + index combination is hashed into a deterministic mnemonic. Different salt values produce different signers. --index lets you derive multiple signers from the same salt.

2. Inspect the cached configuration

lem config show --pretty

Returns the current signer address and derivation path, plus the env vars lem has loaded:

{
  "config": {
    "address": "0xYourSignerAddress",
    "derivationPath": "44'/60'/0'/0/0"
  },
  "env": {
    "RPC_NODE_SEPOLIA_URL": "https://...",
    "SAFE_TRANSACTION_SERVICE_SEPOLIA_URL": "https://..."
  }
}

To find the file on disk:

lem config path
# /Users/you/.config/les-multisig/config.json

The file is created with 0600 permissions in ~/.config/les-multisig/config.json. To switch signers, just run lem connect again. It overwrites the file.

3. Use the signer

Once lem connect has been run, every command that needs the signer picks it up automatically. You do not need to repeat the device flag on every command unless you want to override the cached identity for a single invocation.

lem tx sign --chain-id 11155111 0xYourSafeTxHash

If a signer has not been paired yet, commands that need one fail with exit code 3 (CONFIG_ERROR) and a Run connect to initialize a signing identity suggestion.

Global options

These flags work on every command and can be combined with command-specific flags. See the Command reference for the per-command flag matrix.

Flag	Type	Default	Description
--debug	bool	false	Verbose logs to stderr (the JSON result still goes to stdout).
--timestamps	bool	false	Prefix log lines with ISO-8601 timestamps.
--pretty	bool	false	Pretty-print the JSON output on stdout. Useful for humans; agents should leave it off so output is compact.
--version, -v	bool	false	Print the CLI version and exit.
--env <path>	string	.env	Path to an env file to load before running.
--help, -h	bool	false	Display help for the current command. Works at any level (lem --help, lem safe --help, lem tx propose --help).

Tips and pitfalls

• lem config show does not print mnemonics. It only shows the signer address, derivation path, and known env vars. Mnemonics are never persisted.

• Re-running lem connect overwrites the cached identity. That is by design. There is no concept of "logout".

• Env file scope. --env defaults to .env in the current working directory. Distributed binaries can ship with sensible defaults baked in, so you usually do not need an env file for hosted Ledger services. You only need one for self-hosted endpoints.

• Software signers and CI. When deriving signers via --salt + --index, store the salt itself in a real secret manager. Anyone with the salt and index can sign.

Next steps

• Querying Safe data

• Proposing, signing & executing