JavaScript API

Everything tauri-plugin-keyring-store-api exports, generated from guest-js/index.ts. Option and result types are on the types page; how the pieces fit together is in the guides. Every method is a thin wrapper over one Tauri command; errors arrive as a rejected promise with the error string.

Location

Address of a vault record: a named record (generic) or a numbered one (counter), always inside one vault.

Location.generic()

static generic(vault: VaultPath, record: RecordPath): Location

Record record in vault vault.

Location.counter()

static counter(vault: VaultPath, counter: number): Location

Record number counter in vault vault. Stored under the text of the number: counter(v, 7) is the same record as generic(v, '7').

KeyringClient

Logical client namespace (maps to hashed keyring account segments).

KeyringClient.getVault()

getVault(name: VaultPath): KeyringVault

Vault name of this client: binary records and the SLIP10 / BIP39 / Ed25519 procedures. No IPC call.

KeyringClient.getStore()

getStore(): KeyringStoreView

Key-value byte store of this client. No IPC call.

KeyringStoreView

Binary store backed by keyring entries under this session/client.

KeyringStoreView.get()

get(key: StoreKey): Promise<Uint8Array | null>

Reads the record key; null if it does not exist.

KeyringStoreView.insert()

insert(key: StoreKey, value: Bytes, lifetime?: Duration): Promise<void>

lifetime is accepted for Stronghold parity and ignored (OS stores have no expiry).

KeyringStoreView.remove()

remove(key: StoreKey): Promise<Uint8Array | null>

Deletes the record key; resolves to its previous bytes, or null if there was none.

KeyringVault

Vault record + SLIP10/BIP39 procedures for one vault name.

extends ProcedureExecutor; inherited methods are listed too.

KeyringVault.insert()

insert(recordPath: RecordPath, secret: Bytes): Promise<void>

Writes secret to record recordPath of this vault (replaces an existing one). Stored as Base64 text in the OS store.

KeyringVault.remove()

remove(location: Location): Promise<void>

Removes the record at location, in the vault named by location (not this.name). A counter location n addresses the same record as the generic record String(n).

KeyringVault.generateSLIP10Seed()

generateSLIP10Seed(outputLocation: Location, sizeBytes?: number): Promise<Uint8Array>

Generates a SLIP10 master key into outputLocation (sizeBytes: 16..=64, default 32). Resolves to an empty array: key material never leaves Rust.

KeyringVault.deriveSLIP10()

deriveSLIP10(chain: number[], source: 'Seed' | 'Key', sourceLocation: Location, outputLocation: Location): Promise<Uint8Array>

Derives a hardened child key into outputLocation; resolves to its 32-byte chain code.

KeyringVault.recoverBIP39()

recoverBIP39(mnemonic: string, outputLocation: Location, passphrase?: string): Promise<Uint8Array>

Restores a BIP39 mnemonic into outputLocation; resolves to an empty array.

KeyringVault.generateBIP39()

generateBIP39(outputLocation: Location, passphrase?: string): Promise<Uint8Array>

Generates a 24-word English mnemonic and stores its SLIP10 master key in outputLocation. Resolves to the mnemonic as UTF-8 bytes (new TextDecoder().decode(bytes)) so the user can back it up.

KeyringVault.getEd25519PublicKey()

getEd25519PublicKey(privateKeyLocation: Location): Promise<Uint8Array>

Reads the Ed25519 key at privateKeyLocation (a 32-byte key or a 65-byte SLIP10 extended key) and resolves to its 32-byte public key.

KeyringVault.signEd25519()

signEd25519(privateKeyLocation: Location, msg: string): Promise<Uint8Array>

Signs the UTF-8 bytes of msg with the Ed25519 key at privateKeyLocation; resolves to the 64-byte signature.

KeyringSession

Stronghold-compatible session: register a logical snapshot path (no on-disk file; secrets live in the OS keyring). The password is accepted for API compatibility with Stronghold and is zeroized on the Rust side.

KeyringSession.load()

static load(path: string, password: string): Promise<KeyringSession>

Registers session path for this process (initialize). path is a logical id, not a file; password is not verified and is zeroized in Rust.

KeyringSession.unload()

unload(): Promise<void>

Forgets the session (destroy). Entries stay in the OS store; calls with this path fail until load again.

KeyringSession.loadClient()

loadClient(client: ClientPath): Promise<KeyringClient>

Opens client client of a loaded session. Fails with session not initialized if the session is not loaded.

KeyringSession.createClient()

createClient(client: ClientPath): Promise<KeyringClient>

Same as loadClient: clients need no creation in the OS store. Kept for Stronghold parity.

KeyringSession.save()

save(): Promise<void>

No-op on OS keyring (writes are immediate); fails if the session is not loaded, like Stronghold.

Functions

ping()

ping(value?: string): Promise<string | null>

Ping helper for diagnostics.

getPasswords()

getPasswords(accounts: string[]): Promise<(string | null)[]>

Read many UTF-8 secrets by raw account string (order preserved, null = missing). Accounts starting with kp: are reserved for session records and rejected.

setPasswords()

setPasswords(entries: PasswordEntryDto[]): Promise<void>

Write many UTF-8 secrets.

deletePasswords()

deletePasswords(accounts: string[]): Promise<void>

Delete many keyring entries by account string.

passwordExists()

passwordExists(account: string): Promise<boolean>

True if the account exists with non-empty secret (matches Rust exists_nonempty).

exportPasswordsPlain()

exportPasswordsPlain(accounts: string[]): Promise<PasswordBackupPlainDto>

Plaintext backup over IPC — security: secrets are exposed to the webview process.

importPasswordsPlain()

importPasswordsPlain(backup: PasswordBackupPlainDto): Promise<void>

Restores a backup from exportPasswordsPlain. The whole backup (format version 1, max 256 rows, no kp: accounts) is validated before anything is written; rows with a null secret are skipped.

exportPasswordsEncrypted()

exportPasswordsEncrypted(accounts: string[], passphrase: string): Promise<PasswordBackupEncryptedDto>

Encrypted backup (Argon2id + ChaCha20-Poly1305); always available (independent of Rust crypto / iota-crypto).

importPasswordsEncrypted()

importPasswordsEncrypted(backup: PasswordBackupEncryptedDto, passphrase: string): Promise<void>

Decrypts a backup from exportPasswordsEncrypted with passphrase and restores it like importPasswordsPlain. A wrong passphrase rejects and writes nothing.

joinKeyPrefix()

joinKeyPrefix(prefix: string, name: string): string

Matches Rust join_prefix.

splitKeyPrefix()

splitKeyPrefix(account: string): [string, string]

Matches Rust split_prefixed for exactly two segments.

Constants

KEYRING_PREFIX_SEPARATOR

const KEYRING_PREFIX_SEPARATOR = '.' as const

Same separator as Rust PREFIX_SEPARATOR (prefix.name).