diff --git a/Makefile b/Makefile
index 15118829b..a32192161 100644
--- a/Makefile
+++ b/Makefile
@@ -184,9 +184,9 @@ chat2: | build deps librln
 	echo -e $(BUILD_MSG) "build/$@" && \
 		$(ENV_SCRIPT) nim chat2 $(NIM_PARAMS) $(EXPERIMENTAL_PARAMS) waku.nims
 
-rln_keystore_generator: | build deps librln
+rln-keystore-generator: | build deps librln
 	echo -e $(BUILD_MSG) "build/$@" && \
-		$(ENV_SCRIPT) nim rlnkeystoregenerator $(NIM_PARAMS) $(EXPERIMENTAL_PARAMS) waku.nims
+		$(ENV_SCRIPT) nim rln_keystore_generator $(NIM_PARAMS) $(EXPERIMENTAL_PARAMS) waku.nims
 
 chat2bridge: | build deps
 	echo -e $(BUILD_MSG) "build/$@" && \
diff --git a/tools/rln_keystore_generator/external_config.nim b/tools/rln_keystore_generator/external_config.nim
index 7000bbed7..6c05f3bfe 100644
--- a/tools/rln_keystore_generator/external_config.nim
+++ b/tools/rln_keystore_generator/external_config.nim
@@ -56,6 +56,11 @@ type
       defaultValue: "",
       name: "rln-relay-cred-password" }: string
 
+    rlnRelayEthPrivateKey* {.
+      desc: "Private key for broadcasting transactions",
+      defaultValue: "",
+      name: "rln-relay-eth-private-key" }: string
+
 proc loadConfig*(T: type RlnKeystoreGeneratorConf): Result[T, string] =
   try:
     let conf = RlnKeystoreGeneratorConf.load()
@@ -65,6 +70,8 @@ proc loadConfig*(T: type RlnKeystoreGeneratorConf): Result[T, string] =
       return err("--rln-relay-eth-contract-address must be set")
     if conf.rlnRelayCredPassword == "":
       return err("--rln-relay-cred-password must be set")
+    if conf.rlnRelayEthPrivateKey == "":
+      return err("--rln-relay-eth-private-key must be set")
     ok(conf)
   except CatchableError:
     err(getCurrentExceptionMsg())
diff --git a/tools/rln_keystore_generator/rln_keystore_generator.nim b/tools/rln_keystore_generator/rln_keystore_generator.nim
index 58e14dbac..41116001d 100644
--- a/tools/rln_keystore_generator/rln_keystore_generator.nim
+++ b/tools/rln_keystore_generator/rln_keystore_generator.nim
@@ -12,6 +12,7 @@ import
   ../../waku/waku_keystore,
   ../../waku/waku_rln_relay/rln,
   ../../waku/waku_rln_relay/conversion_utils,
+  ../../waku/waku_rln_relay/group_manager/on_chain,
   ./external_config
 
 logScope:
@@ -35,7 +36,7 @@ when isMainModule:
   if rlnInstanceRes.isErr():
     error "failure while creating RLN instance", error=rlnInstanceRes.error
     quit(1)
-  
+
   let rlnInstance = rlnInstanceRes.get()
 
   # 3. generate credentials
@@ -50,17 +51,44 @@ when isMainModule:
                        idSecretHash = credential.idSecretHash.inHex(),
                        idCommitment = credential.idCommitment.inHex()
 
-  # 4. write to keystore
-  ## TODO: after hooking up to the OnchainGroupManager, 
-  ## obtain chainId and treeIndex from the contract
+  
+  if not conf.execute:
+    info "not executing, exiting"
+    quit(0)
+
+  # 4. initialize OnchainGroupManager
+  let groupManager = OnchainGroupManager(ethClientUrl: conf.rlnRelayEthClientAddress,
+                                         ethContractAddress: conf.rlnRelayEthContractAddress,
+                                         rlnInstance: rlnInstance,
+                                         keystorePath: none(string),
+                                         keystorePassword: none(string),
+                                         ethPrivateKey: some(conf.rlnRelayEthPrivateKey),
+                                         # saveKeystore = false, since we're managing it
+                                         saveKeystore: false)
+  try:
+    waitFor groupManager.init()
+  except CatchableError:
+    error "failure while initializing OnchainGroupManager", error=getCurrentExceptionMsg()
+    quit(1)
+
+  # 5. register on-chain
+  try:
+    waitFor groupManager.register(credential)
+  except CatchableError:
+    error "failure while registering credentials on-chain", error=getCurrentExceptionMsg()
+    quit(1)
+
+  debug "Transaction hash", txHash = groupManager.registrationTxHash.get()
+
+  # 6. write to keystore
   let keystoreCred = MembershipCredentials(
     identityCredential: credential,
     membershipGroups: @[MembershipGroup(
       membershipContract: MembershipContract(
-        chainId: "1155511",
+        chainId: $groupManager.chainId.get(),
         address: conf.rlnRelayEthContractAddress,
       ),
-      treeIndex: 0,
+      treeIndex: groupManager.membershipIndex.get(),
     )]
   )
 
@@ -74,6 +102,5 @@ when isMainModule:
   
   info "credentials persisted", path = conf.rlnRelayCredPath
 
-  
-
-
+  waitFor groupManager.stop()
+  quit(0)