Lesson 05 · Web3 with Go & Polygon

Keys, Accounts & Addresses

So far you've only read the chain — reads need no permission. But your client's backend must eventually write: deploy the token, mint shares, move them. Every write is a transaction, and every transaction must be signed by a private key. This lesson is the theory of keys — the heart of Web3 — and ends with a Go program that mints a brand-new wallet you'll use for the rest of the course.

The win A Go program that generates a fresh keypair and derives its Amoy address — the account your backend will sign with. Fund it once from the faucet and it's your project's signer.

One key, three derived things

It all starts with one secret random number: the private key. Everything else is computed from it, one direction only — you can go down the chain, never back up.

Private key: A 256-bit random number. Whoever holds it controls the account — full stop. It never touches the chain and must never be shared or committed to git.
Public key: Derived from the private key by elliptic-curve math (ECDSA, the secp256k1 curve). Safe to share. You can't reverse it back to the private key.
Address: The last 20 bytes of the public key's Keccak-256 hash, written as 0x…. This is the public name of the account — the thing you read balances of.

private key → public key → address. A one-way street. That asymmetry is the entire security model.

How signing proves ownership

To move shares, your backend signs the transaction with the private key. The network checks the signature against the sender's public key — no secret is ever revealed, yet everyone can verify the sender authorized it. This is why the industry mantra is:

Not your keys, not your coins Ownership on-chain is control of the private key. There's no support line, no password reset. For your client's product this cuts both ways: total sovereignty, and total responsibility for key custody. Flag it early — it shapes how you'll store the signer.

Generate your project's wallet in Go

main.go

package main

import (
	"crypto/ecdsa"
	"fmt"
	"log"

	"github.com/ethereum/go-ethereum/common/hexutil"
	"github.com/ethereum/go-ethereum/crypto"
)

func main() {
	// 1. A brand-new private key — the one secret that controls the account.
	privateKey, err := crypto.GenerateKey()
	if err != nil {
		log.Fatal(err)
	}
	privBytes := crypto.FromECDSA(privateKey)
	fmt.Println("private key:", hexutil.Encode(privBytes)) // keep this SECRET

	// 2. Derive the public key from the private key.
	publicKey, ok := privateKey.Public().(*ecdsa.PublicKey)
	if !ok {
		log.Fatal("could not cast public key to ECDSA")
	}

	// 3. The address is derived from the public key.
	address := crypto.PubkeyToAddress(*publicKey)
	fmt.Println("address:    ", address.Hex())
}

Run it:

terminal

go run main.go

private key: 0x9c6f... (SECRET — never share or commit)
address:     0x8A2f1C...c47B

You did it You just created an EOA (from Lesson 02) from scratch — no wallet app, no website, just math and Go. Paste that address into your Lesson 02 balance reader: it reads 0, because a fresh account is empty until funded. Now grab test POL for it from the Amoy faucet and read it again.

Handle the private key like a live wire Never hardcode it, never commit it, never log it in production. Load it from an environment variable or a secrets manager. Anyone who reads that string can drain — or, once shares exist, steal — everything the account controls. On testnet the stakes are fake; build the safe habit now, before real value is on the line.

Check yourself

1. What is the correct derivation direction?

2. An account's 0x… address is derived from a hash of the…

3. Signing a transaction proves authorization while keeping what hidden?

4. A freshly generated account, before funding, has a balance of…

Primary source · read this next
Ethereum Development with Go — Generating a New Wallet, then ethereum.org — Accounts for the theory behind key derivation. This wallet is what we'll sign and deploy with next.

I'm your teacher — ask me anything. Want to understand ECDSA and secp256k1 more deeply? Curious how a seed phrase relates to this private key? Ready to load the key safely from an env var and sign your first write transaction? That's exactly where we go next — ask.