§ Wiki · Wiki entry

Node Provider Onboarding

The technical procedure for becoming an accepted node provider on the Internet Computer, from tool installation through NNS proposal and node operator records.

·May 4, 2026·5 min read

This entry describes the technical procedure for joining the network as a node provider — registering with the NNS, setting up keys, and producing the records the network needs before any hardware is installed. The roadmap that frames it lives at Node Provider Roadmap.

The end-to-end process typically takes around a week. NNS proposal acceptance can take several days, and corrections sometimes require a fresh submission.

[!WARNING] No new node machines are being onboarded at present — the network reached its target topology in December 2023. This entry remains faithful to the procedure as documented; existing providers performing further onboarding (for example after Gen-1 expiry) still follow it.

Prerequisites

Before starting:

  • Hardware that meets the node hardware specification.
  • A read of the networking guide.
  • A hardware wallet — Ledger Nano is the supported choice.
  • 26 ICP in that wallet (25 ICP is the proposal deposit; the extra covers fees and rounding).
  • Working familiarity with NNS neurons, staking, and proposal voting.

Step 1 — Install ic-admin and dfx

ic-admin is the command-line tool used to submit node-provider governance proposals. Install the latest release for your platform:

macOS:

curl -L "https://github.com/dfinity/ic/releases/latest/download/ic-admin-x86_64-darwin.gz" \
  -o - | gunzip > ic-admin && chmod 0755 ./ic-admin

Linux (Ubuntu 20.04):

curl -L "https://github.com/dfinity/ic/releases/latest/download/ic-admin-x86_64-linux.gz" \
  -o - | gunzip > ic-admin && chmod 0755 ./ic-admin

dfx is the DFINITY canister SDK; it is needed for the identity tooling.

sh -ci "$(curl -fsSL https://internetcomputer.org/install.sh)"
export PATH=$HOME/bin:$PATH
dfx upgrade

dfx version 0.14 or later is required.

Step 2 — Create the node-provider hotkey

The hotkey is a software identity used to submit NNS proposals on behalf of the neuron held on the hardware wallet. It is not the same thing as the node-provider principal.

dfx identity new --storage-mode=plaintext node-provider-hotkey
dfx --identity node-provider-hotkey identity get-principal

Save the printed principal.

Step 3 — Stake a neuron

Through the NNS frontend dapp, using the hardware wallet:

  1. Send at least 26 ICP to the hardware wallet.
  2. Under Neurons, stake at least 26 ICP.
  3. Confirm the transaction on the hardware wallet.
  4. Add the NNS dapp as a hotkey on the neuron.
  5. Set a dissolve delay of at least 6 months (proposal-submission threshold).
  6. Copy and save the neuron ID.

Step 4 — Add the node-provider hotkey to the neuron

Add the principal from step 2 as a hotkey on the neuron from step 3. This is what lets ic-admin submit proposals signed by your neuron without exposing the hardware wallet to the command line.

Step 5 — Choose the onboarding path

Two paths exist depending on hardware generation:

The remaining steps below describe the non-HSM (Gen-2) flow.

Step 6 — Generate node-operator keys

A node-operator principal is the identity used to onboard each node machine in a given data center. One principal per data center — multiple data centers need multiple principals.

dfx identity new --storage-mode=plaintext node_operator
cp ~/.config/dfx/identity/node_operator/identity.pem ./node_operator_private_key.pem

The first line of node_operator_private_key.pem should read:

-----BEGIN EC PRIVATE KEY-----

[!WARNING] Keep node_operator_private_key.pem safe. It is required during node machine onboarding (milestone five of the roadmap).

Step 7 — Capture the node-operator principal

dfx --identity node_operator identity get-principal

Save the value as NODE_OPERATOR_PRINCIPAL.

Step 8 — Register the node provider with the NNS

The registration proposal records the legal entity behind the provider and links it to the hardware wallet that controls the neuron. The proposal summary includes the hashes of the self-declaration and proof of identity documents — see Node Provider Self-declaration.

Variables:

  • NODE_PROVIDER_NAME — the legal entity's name.
  • NODE_PROVIDER_PRINCIPAL — the principal of the Ledger hardware wallet.
  • NEURON_ID — from step 3.
./ic-admin \
  --nns-url https://ic0.app \
  -s ~/.config/dfx/identity/node-provider-hotkey/identity.pem \
  propose-to-add-or-remove-node-provider add \
  --proposer $NEURON_ID \
  --proposal-title "Register a node provider '${NODE_PROVIDER_NAME}'" \
  --summary "[forum link, document hashes, identity details]" \
  --node-provider-pid "$NODE_PROVIDER_PRINCIPAL"

The summary should include a link to the discussion thread on forum.dfinity.org, the company webpage, and SHA-256 hashes of the self-declaration and identity documents.

Step 9 — Register the data center (if new)

Check the existing list at dashboard.internetcomputer.org/centers. If the data center is already registered, skip this step.

A new data-center record needs:

  • ID — two-letter city code plus an incrementing number, e.g. dl1, zh10.
  • Region — Continent,Country Code,Region format, e.g. North America,US,Texas.
  • Owner — the data-center operator's entity name.
  • GPS coordinates — taken from Google Maps.
./ic-admin \
  --nns-url https://ic0.app \
  -s ~/.config/dfx/identity/node-provider-hotkey/identity.pem \
  propose-to-add-or-remove-data-centers \
  --summary "[data center details]" \
  --skip-confirmation \
  --proposer $NEURON_ID \
  --data-centers-to-add '[JSON data-center object]'

Step 10 — Create the node-operator record

Before submitting, validate the candidate machines against the network decentralization targets — see Validation of Candidate Node Machines.

Variables required for the node-operator proposal:

  • NEURON_ID
  • NODE_PROVIDER_PRINCIPAL
  • NODE_OPERATOR_PRINCIPAL — from step 7; one per data center.
  • Rewardable nodes — JSON, e.g. {"type3.1": 1}.
  • Data-center ID — from step 9 or the dashboard list.

Tracking and announcements

Support

[!NOTE] The node-provider hotkey is distinct from the node-provider principal. The hotkey only signs NNS proposals; the principal, derived from the hardware wallet, is the long-lived identity of the provider. Do not confuse them.

Related