Native Secrets

The in-repo Tauri plugin that keeps your API key in the phone's keychain, not in process memory.

An API key you paste into the app lives in the platform keychain — iOS / macOS Keychain, Android EncryptedSharedPreferences — and survives an app restart.

Quick Start

1. Build the mobile shell — you already get the native store

   There is no SDK call to make. secretsFor(kind, bridge) in app/src/platform.ts picks the keychain for you the moment the app runs inside the Tauri shell.

   // app/src/platform.ts — the store is chosen from the detected platform kind.
   export function secretsFor(kind, bridge): SecretsPort {
     if (kind !== "tauri") return createWebSecrets();       // browser: a Map
     return createTauriSecrets({ invoke: bridge.invokeStrict }); // phone: the keychain
   }

2. Paste a key in Settings

   Under Engine → OpenAI API key, paste the key and blur the field. It is written straight to the keychain, and the presence label flips to Configured.

3. Restart the app

   Reopen the app. The key is still there — the settings row reads Configured, and the next message is authenticated with no re-entry. See API Keys.

How It Works

A pasted key travels from the webview through Tauri IPC to a Rust command, which writes it to the platform’s native store.

The webview reaches the store through four commands, declared once in src-tauri/src/secrets.rs and matched on the TS side in adapters/src/tauri/secrets.ts.

The four names are pinned to agree across the seam by tools/secrets-seam.test.mjs ("the four secret command names agree across the seam"), and each is registered with Tauri in src-tauri/src/lib.rs ("every command the adapter can send is registered with Tauri").

Per-platform behaviour

The store is picked from the detected platform kind; an unsupported host stores nothing.

Because the plugin refuses rather than falling back on an unsupported platform, “a secret stored through this adapter at all is in a hardware-backed store” is an invariant — which is why isHardwareBacked can be answered synchronously during the first paint, with no async probe. Source: adapters/src/tauri/secrets.ts header, secretsFor in app/src/platform.ts.

Design decisions

Android backup & restore

The store self-heals after a Google auto-backup restores the app onto a new device.

The master key that decrypts EncryptedSharedPreferences is generated inside AndroidKeyStore and is device-local — it does not travel with the backup. So the restored preferences file cannot be decrypted, and EncryptedSharedPreferences.create throws a KeyStoreException.

store() in SecretsPlugin.kt catches that exception, calls discard() — which uses context.deleteSharedPreferences(PREFS_FILE), not getSharedPreferences(...).edit().clear(), because a cleared handle still points at a file it cannot read — and rebuilds the store from scratch. Future writes work; any pre-restore secrets are gone and the user re-enters them once, exactly like a fresh install.

Verification on device

How you would check yourself that the key never leaks — the same evidence collected on the PR.

Related