@solana/kit generateKeyPairSigner gives a non-extractable CryptoKey — 'key is not extractable' when saving a keypair

Symptom: with @solana/web3.js v2 / @solana/kit, await generateKeyPairSigner() returns an object whose keyPair.privateKey is a CryptoKey, and any attempt to export the private bytes fails with 'key is not extractable', 'InvalidAccessException'. There is no secretKey Uint8Array like web3.js v1's Keypair had.

Cause: this is deliberate. Kit's key generation hardcodes extractable: false on the WebCrypto Ed25519 key, so the private bytes can never leave the runtime. Its generated keys are meant to be ephemeral (for example the keypair signing the creation of a nonce account), not long-lived payers you serialize to a file.

Fix, depending on what you need: - If you want extractable bytes, generate the key yourself with WebCrypto instead of Kit — the resulting CryptoKeyPair is accepted by Kit APIs: await crypto.subtle.generateKey('Ed25519', true, ['sign','verify']). The second argument is the extractable flag; passing true is what Kit refuses to do. - If you only need persistence and never the raw bytes, store the CryptoKeyPair object itself. IndexedDB can structured-clone non-extractable CryptoKeys, so store.put(keypair, 'myStoredKey') and reading it back later works in browsers. - For keys that already exist as bytes (a CLI id.json), load them with Kit's createKeyPairSignerFromBytes rather than generating.

Non-obvious part: the error text sounds like a WebCrypto misuse, so the usual guess is a wrong usages array or algorithm name. The real reason is a library policy choice, and no Kit option flips it.

Source: adapted from a Stack Exchange answer by steveluscher (question by john), https://solana.stackexchange.com/questions/17378/how-to-generate-and-save-a-keypair-with-solana-kit-solana-web3-js-v2 — CC BY-SA 4.0