Secrets in the OS keyring for Tauri 2 apps

Store passwords, records and wallet keys in the platform credential store from your Tauri frontend or backend, on desktop, Android and iOS.

Get started GitHub

What you get

OS credential store
macOS Keychain, Windows Credential Manager, Linux Secret Service, Android and iOS keystores through keyring-core. No snapshot file, no in-memory fallback.
Stronghold-shaped API
Sessions, clients, store and vault with the same calls as tauri-plugin-stronghold, so migrating is mostly an import change.
Wallet procedures
SLIP10, BIP39 and Ed25519 run in Rust; private keys stay in the keyring and never reach the webview.
Password accounts
Bulk get / set / delete of plain accounts, plus plaintext or Argon2id + ChaCha20-Poly1305 encrypted backups.
Rust backend
app.keyring().store gives KeyringStore to your own commands, with iOS background-read helpers.
Generated reference
Every class, function, type, Tauri command and permission, built from the sources on each release.

Session, store, vault

Open a session, write a store record, keep a wallet key in the vault. Every call is one entry in the OS keyring under your app service name.

Quick start Security notes

main.ts

import { KeyringSession, Location, setPasswords, getPasswords } from "tauri-plugin-keyring-store-api";

// Plain accounts: one OS keyring entry each.
await setPasswords([{ account: "app.api_token", secret: "s3cr3t" }]);
const [token] = await getPasswords(["app.api_token"]);

// Stronghold-style session, store and vault.
const session = await KeyringSession.load("/wallet/main", "");
const client = await session.createClient("main");
await client.getStore().insert("prefs", new TextEncoder().encode("{}"));

const vault = client.getVault("PRIMARY");
const master = Location.generic("PRIMARY", "master");
const words = new TextDecoder().decode(await vault.generateBIP39(master)); // show once for backup
const signature = await vault.signEd25519(master, "hello");                // 64 bytes