---
title: "Ethereum with an external CL"
description: "Connect Lighthouse, Prysm, or another consensus client to Erigon for a full Ethereum node."
sidebar_position: 1
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# Ethereum with an external CL

You can use **Prysm**, **Lighthouse**, or any other Consensus Layer client with Erigon by including the `--externalcl` flag. This integration enables direct access to the Ethereum blockchain, allowing you to manage your keys for staking ETH and block production.

:::warning
The Engine API drives block processing, so anything that can reach it and holds
your JWT secret controls the node. The steps below widen it past localhost only
so a CL on another machine can connect — when you do that, protect it:

* prefer the specific interface — `--authrpc.addr <this-host-LAN-IP>` — over
  `0.0.0.0`, which listens on every interface including any public one;
* restrict port `8551` at the firewall to the CL host's address, and never
  expose it to the internet;
* treat `--authrpc.vhosts` as a `Host`-header check, not a network control: it
  is not a substitute for a firewall rule;
* keep `jwt.hex` readable only by the accounts that need it, and copy it to the
  CL host over a private channel.

If both clients run on the same machine, leave the Engine API on its default
localhost address and skip those flags entirely.
:::

:::tip
Keep your consensus client current, the same way you would Erigon. Beyond fixes
and performance work, a CL carries the fork schedule it was built with: a
version released before an upcoming hard fork may not follow the chain through
it, which stalls your execution layer too. Watch your client's releases
([Prysm](https://github.com/OffchainLabs/prysm/releases),
[Lighthouse](https://github.com/sigp/lighthouse/releases)) and upgrade before
scheduled forks, not after.
:::

## Erigon with Prysm as the external CL

<Tabs>
<TabItem value="prysm" label="Prysm">
1.  Start Erigon adding the `--externalcl` flag:

    ```bash
    erigon --externalcl
    ```

    If your Consensus Layer (CL) client is on a different device, add the following flags:

    * `--authrpc.addr <this-host-LAN-IP>` — the Engine API listens on localhost by default, so it has to be widened for a remote CL. Read the warning below before reaching for `0.0.0.0`;
    * `--authrpc.vhosts <CL_host>` where \<CL\_host> is the source host or the appropriate hostname that your CL client is using.
2.  Install and run **Prysm** by following the official guide: [https://docs.prylabs.network/docs/install/install-with-script](https://docs.prylabs.network/docs/install/install-with-script).

    Prysm must fully synchronize before Erigon can start syncing, since Erigon requires an existing target head to sync to. The quickest way to get Prysm synced is to use a public checkpoint synchronization endpoint from the list at [https://eth-clients.github.io/checkpoint-sync-endpoints](https://eth-clients.github.io/checkpoint-sync-endpoints).
3. To communicate with Erigon, the `--execution-endpoint` must be specified as `<erigon address>:8551`, where `<erigon address>` is either `http://localhost` or the IP address of the device running Erigon.
4.  Prysm must point to the [JWT secret](../../../fundamentals/jwt) automatically created by Erigon in the `--datadir` directory.

    ```bash
    ./prysm.sh beacon-chain \
    --execution-endpoint http://localhost:8551 \
    --mainnet --jwt-secret=<your-datadir>/jwt.hex \
    --checkpoint-sync-url=https://beaconstate.info \
    --genesis-beacon-api-url=https://beaconstate.info
    ```
</TabItem>
<TabItem value="lighthouse" label="Lighthouse">
1.  Start Erigon adding the `--externalcl` flag:

    ```bash
    erigon --externalcl
    ```
2. Install and run Lighthouse by following the official guide: [https://lighthouse-book.sigmaprime.io/installation.html](https://lighthouse-book.sigmaprime.io/installation.html)
3. Because Erigon needs a target head in order to sync, Lighthouse must be synced before Erigon can synchronize. The fastest way to synchronize Lighthouse is to use one of the many public checkpoint synchronization endpoints at [https://eth-clients.github.io/checkpoint-sync-endpoints](https://eth-clients.github.io/checkpoint-sync-endpoints).
4. To communicate with Erigon, the `--execution-endpoint` must be specified as `<erigon address>:8551`, where `<erigon address>` is either `http://localhost` or the IP address of the device running Erigon.
5.  Lighthouse must point to the [JWT secret](../../../fundamentals/jwt) automatically created by Erigon in the `--datadir` directory.

    ```bash
    lighthouse bn \
    --network mainnet \
    --execution-endpoint http://localhost:8551 \
    --execution-jwt <your-datadir>/jwt.hex \
    --checkpoint-sync-url https://mainnet.checkpoint.sigp.io
    ```
</TabItem>
</Tabs>

Check Erigon and your chosen CL logs to make sure that the Execution Layer (EL) and CL are communicating and that your node is syncing correctly.
