solana cli paper wallets generating a different pubkey

Question

When creating a paper wallet with the solana cli and then running the seed phrase back into the cli I get a completely different pubkey?

What am I missing here?

Not using a passphase in this example.

❯ solana-keygen new --no-outfile

Generating a new keypair

For added security, enter a BIP39 passphrase

NOTE! This passphrase improves security of the recovery seed phrase NOT the
keypair file itself, which is stored as insecure plain text

BIP39 Passphrase (empty for none): none

===============================================================================
pubkey: 7A5h8N21EtjAnfcf8kxp7Bd7pNtQ5SvoYHLyBwz2796e
===============================================================================
Save this seed phrase and your BIP39 passphrase to recover your new keypair:
animal flock border attitude simple piece firm reason snack isolate siege seven
===============================================================================

~/.config/solana
❯ solana-keygen pubkey prompt://

[pubkey recovery] seed phrase: 
[pubkey recovery] If this seed phrase has an associated passphrase, enter it now. Otherwise, press ENTER to continue: 
2NW5bHw8dh4rS9wZSPj5u6Xec9tCHEN64PiTPUiy2ms7

Answer 1

This is a bit confusing between the BIP44 and BIP39 derivation paths. The seed phrase shown animal flock border attitude simple piece firm reason snack isolate siege seven comes from the legacy derivation, so it should be used with the ASK keyword instead of the prompt:// keyword.

If you want to recover the expected public key, you'll have to run:

$ solana-keygen pubkey ASK

More information found towards the bottom of this section of the docs: https://docs.solana.com/wallet-guide/paper-wallet#public-key-derivation