Passkeys and recovery

@nostr-wot/identity/vault provides portable passkey vault records, encrypted recovery payloads and provider/relay orchestration for browser and native applications.

Your app creates the account and performs the native passkey ceremony. Supply the verified credential ID, RP, PRF input and output to the record functions; the SDK does not open a browser prompt or grant access to a domain. Never persist or log PRF output.

import {
  createPasskeyRecord, openPasskeyRecord, parsePasskeyBackup,
  serializePasskeyBackup, sealPasskeyPayload, withPasskeyVaultKey,
  type VaultPayload, type PasskeyInput, type PasskeyProof,
} from "@nostr-wot/identity/vault";

export function protectAccount(payload: VaultPayload, enrollment: PasskeyInput) {
  const record = createPasskeyRecord(payload, enrollment);
  return { record, recoveryFile: serializePasskeyBackup(record) };
}

export async function readRecoveryFile(file: string, proof: PasskeyProof) {
  let record = parsePasskeyBackup(file);
  const opened = await openPasskeyRecord(record, proof);
  if (opened.cacheKeyMinted) {
    record = await withPasskeyVaultKey(record, proof, key =>
      sealPasskeyPayload(opened.payload, key, record),
    );
  }
  return { record, payload: opened.payload };
}

This example encrypts an existing account payload and opens an encrypted recovery file. After opening, validate the recovered accounts and expected public key, enforce your vault replacement policy and persist the returned record atomically. Re-sealing a minted cache key is required before using that cache. The password-only Vault class does not unlock v2 passkey records.

Provider and relay adapters

saveRecovery and restoreRecovery accept your RecoveryProvider, RecoveryTransport and signature verifier. Saving also requires the recovery author’s signing function. Reuse your relay connections, enforce session checks at writes, and require explicit consent for relay publication. Configure the same bootstrap recovery relays for enrollment and fresh-device restore; the SDK supplies no hidden relay list.

Package API and record examples