| Crates.io | tauri-plugin-secure-element |
| lib.rs | tauri-plugin-secure-element |
| version | 0.1.0-beta.1 |
| created_at | 2025-12-14 23:34:10.681712+00 |
| updated_at | 2026-01-01 22:25:57.240496+00 |
| description | Tauri plugin for secure element use on iOS (Secure Enclave) and Android (Strongbox and TEE). |
| homepage | https://github.com/dkackman/tauri-plugin-secure-element |
| repository | https://github.com/dkackman/tauri-plugin-secure-element |
| max_upload_size | |
| id | 1985280 |
| size | 329,479 |
A Tauri plugin for secure element functionality on macOS & iOS (Secure Enclave) and Android (StrongBox and TEE).
npm install tauri-plugin-secure-element-api
# or
pnpm add tauri-plugin-secure-element-api
# or
yarn add tauri-plugin-secure-element-api
[dependencies]
tauri-plugin-secure-element = "0.1.0-beta.1"
Add the plugin to your Rust code in src-tauri/src/lib.rs:
#[cfg_attr(mobile, tauri::mobile_entry_point)]
pub fn run() {
tauri::Builder::default()
.plugin(tauri_plugin_secure_element::init())
// ... other plugins
.run(tauri::generate_context!())
.expect("error while running tauri application");
}
Add the plugin permissions to src-tauri/capabilities/default.json:
{
"identifier": "default",
"description": "Capability for the main window",
"windows": ["main"],
"permissions": ["core:default", "secure-element:default"]
}
In order to use biometric protected keys, add this to src-tauri/gen/android/app/build.gradle.kts:
dependencies {
implementation("androidx.biometric:biometric:1.1.0")
}
Note: The src-tauri/gen/android folder is generated by Tauri but should be committed to version control and customized as needed. Once you add the biometric dependency, it will persist across builds (you only need to add it again if you completely regenerate the Android project with tauri android init).
Important: For authentication-required keys to work on iOS with Face ID, you must add the Face ID usage description to your iOS Info.plist.
Add to src-tauri/gen/apple/tauri-app_iOS/Info.plist (replace tauri-app_iOS with your app name):
<key>NSFaceIDUsageDescription</key>
<string>This app uses Face ID to authenticate access to your secure keys.</string>
Add this entry anywhere within the <dict> section of the Info.plist file.
Note: Like the Android configuration, the src-tauri/gen/apple folder should be committed to version control. The Face ID permission will persist across builds unless you regenerate the iOS project with tauri ios init.
Touch ID does not require a separate permission entry - it works automatically when Face ID permission is granted or when no biometric hardware is available.
import {
checkSecureElementSupport,
generateSecureKey,
listKeys,
signWithKey,
deleteKey,
type AuthenticationMode,
} from "tauri-plugin-secure-element-api";
// Check if secure element is supported
const support = await checkSecureElementSupport();
console.log("Secure element supported:", support.secureElementSupported);
// Generate a new secure key
const { publicKey, keyName } = await generateSecureKey(
"my-key-name",
"pinOrBiometric" // or 'none' or 'biometricOnly'
);
// List all keys
const keys = await listKeys();
// Sign data with a key
const data = new Uint8Array([1, 2, 3, 4]);
const signature = await signWithKey("my-key-name", data);
// Delete a key
await deleteKey("my-key-name");
checkSecureElementSupport()Returns information about secure element support on the device.
Returns: Promise<SecureElementSupport>
interface SecureElementSupport {
secureElementSupported: boolean;
teeSupported: boolean;
canEnforceBiometricOnly: boolean;
}
generateSecureKey(keyName: string, authMode?: AuthenticationMode)Generates a new secure key in the device's secure element.
Parameters:
keyName: Unique name for the keyauthMode: Authentication mode ('none', 'pinOrBiometric', or 'biometricOnly')Returns: Promise<GenerateSecureKeyResult>
interface GenerateSecureKeyResult {
publicKey: string;
keyName: string;
hardwareBacking: "secureEnclave" | "strongBox" | "tee";
}
Note: The biometricOnly mode requires Android 11 (API 30) or higher. On older Android versions, this mode will be rejected with an error. Use checkSecureElementSupport().canEnforceBiometricOnly to check support before creating biometric-only keys.
listKeys(keyName?: string, publicKey?: string)Lists keys stored in the secure element. Can filter by key name or public key.
Returns: Promise<KeyInfo[]>
interface KeyInfo {
keyName: string;
publicKey: string;
}
signWithKey(keyName: string, data: Uint8Array)Signs data using a key stored in the secure element.
Parameters:
keyName: Name of the key to usedata: Data to sign as Uint8ArrayReturns: Promise<Uint8Array> - The signature
deleteKey(keyName?: string, publicKey?: string)Deletes a key from the secure element. At least one parameter must be provided.
Returns: Promise<boolean> - Success status
Public keys are returned as base64-encoded strings in X9.62 uncompressed point format (65 bytes), consistent across all platforms:
| Byte(s) | Content |
|---|---|
| 0 | 0x04 (uncompressed) |
| 1-32 | X coordinate (32 bytes) |
| 33-64 | Y coordinate (32 bytes) |
All keys use the secp256r1 (P-256) elliptic curve.
| Feature | Requirement | Notes |
|---|---|---|
| Hardware-backed keys | API 23+ | TEE or StrongBox required |
| StrongBox | API 28+ | Falls back to TEE if unavailable |
biometricOnly auth mode |
API 30+ | Rejected on older versions |
| Mode | iOS/MacOS | Android | Windows |
|---|---|---|---|
none |
✅ No auth required | ✅ No auth required | ✅ No auth required |
pinOrBiometric |
✅ Face ID, Touch ID, or passcode | ✅ Biometric or PIN/pattern/password | ✅ Windows Hello |
biometricOnly |
❌ Not supported | ✅ API 30+ only, biometric only | ❌ Not supported |
Apache-2.0
Contributions are welcome! Please feel free to submit a Pull Request.