Nansen Wallet Keychain Migration

Handles the awkward transition from nansen-cli's old password storage (env files, .credentials) to the new keychain-backed system. You'll want this when users hit the "Password loaded from insecure .credentials file" warning or mention they stored credentials in ~/.nansen/.env. The skill walks through four migration paths depending on where the password currently lives, always verifying the keychain actually decrypts the wallet afterward with `nansen wallet export`. The verification step matters because `wallet show` doesn't touch the password at all, so it won't catch a botched migration. Main gotcha is that agents can't use interactive prompts, so everything routes through NANSEN_WALLET_PASSWORD env var or sourcing existing files in the same shell.

skills.sh installs: 358
GitHub stars: 148
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add nansen-ai/nansen-cli --skill nansen-wallet-keychain-migration --agent claude-code

Installs into .claude/skills of the current project.

Files

Authentication

Nansen account API calls accept a selected nansen:api browser session or conventional API key with the same permissions. NANSEN_API_KEY takes precedence; optional primaryEnv preserves configured-key injection. Run nansen auth status for offline selection. Cached access expiry alone permits automatic renewal during an authorized task. Stop on anonymous selection, invalid state, blocked/uncertain renewal or actual auth failure; never drop a credential or fall back to anonymous x402 payment. Browser login does not grant wallet signing, privileged service identity or a persistent MCP integration key. Preserve all confirmation, signing, sanctions and geographic checks below. Browser login is enabled in production within the documented platform scope.

Wallet Migration — Old Flow to Secure Keychain

Use this skill when a user already has a nansen-cli wallet set up with the old password storage method and wants to migrate to the new secure flow.