Keycard Shell is fully open source. You can build your own device, run your own firmware, and pair it with your own Keycards. This is an advanced workflow intended for builders and developers.
Production Keycard Shell devices only accept signed firmware updates. To run custom firmware you must build your own device (or a dev unit) with a bootloader key you control.
1
Build or install the Keycard applet. Start with Build Your Own Keycard and install the applet on a JavaCard 3.0.4+ card (3.0.5 recommended). 2
Build the Shell hardware. Use the open-source schematics, PCB files, and mechanical designs from the Keycard Shell repo.
3
Build and sign firmware. Compile the firmware with STM32CubeIDE and sign it with your own bootloader key. Use the create-image tooling to generate a flashable image.
4
(Optional) Build a custom database. Generate a clear-signing database that matches your supported chains and ABIs.
5
Assemble and test. Insert your Keycard and complete onboarding like a production device.
All hardware design files are open source, in the Keycard Shell repo:
Electronic bill of materials, schematics and layout
Mechanical bill of materials and full 3D definition of all parts
The bootloader verifies a secp256k1 signature with an embedded public key before booting (bootloader verification code), so your build must be signed with your own keys. Follow the Keycard Shell build notes for the full toolchain setup, signing procedure and image creation.
For the database format and tooling used in step 4, see the Shell API reference.