@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.21 → 1.0.0-canary.22

package/ARCHITECTURE.md

@@ -58,7 +58,7 @@ The iOS part is implemented using Swift.
 
 The following methods are exposed to the JavaScript layer:
 
-- `setMasterKey(secret: string)`: Sets the master key for credential encryption/decryption.
+- `setMasterKey(secret: Uint8Array)`: Sets the master key for credential encryption/decryption. Takes raw bytes (not a hex string) so the secret never becomes a non-zeroable JS string.
 - `setHdRootKeyId(id: string)`: Sets the ID for the HD root key.
 - `getHdRootKeyId()`: Retrieves the current HD root key ID.
 - `configureIntentActions(getPasskeyAction: string, createPasskeyAction: string)`: Configures the intent actions used for Passkey flows.
@@ -68,7 +68,7 @@ The following methods are exposed to the JavaScript layer:
 
 ## Security Considerations
 
-As this module handles sensitive information (Passkeys), it is crucial to ensure that keys and secrets are handled securely in the native layers. Master keys should be stored in secure storage (like Android Keystore or iOS Keychain).
+As this module handles sensitive information (Passkeys), keys and secrets are handled securely in the native layers. The master key is stored in platform secure storage — never in plaintext: on Android it is AES/GCM-encrypted under the AndroidKeyStore, and on iOS it is held in the Keychain (`kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`) within a shared keychain access group so the app and the AutoFill extension can both read it. It is deliberately not biometric-gated, because the extension must read it to enumerate credentials before the user authenticates; biometric verification is applied at the assertion step instead. The master key crosses the JS↔native bridge as raw bytes (`Uint8Array`), never as a hex string.
 
 ## End-to-End Tests
 

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+# [1.0.0-canary.22](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.21...v1.0.0-canary.22) (2026-07-15)
+
+### Bug Fixes
+
+- write keychain group into the extension Info.plist so the extension can resolve it ([a98ea08](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/a98ea0827164b5402a3f530579cd6908e52c0242))
+
+### Features
+
+- accept the master key as raw bytes instead of a hex string ([86f85a8](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/86f85a8667489f938266188f7551598c3e14cc0c))
+- store the iOS master key in the Keychain instead of plaintext UserDefaults ([00dd362](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/00dd362d7214e91296982e012aedd817b09ab83d))
+
 # [1.0.0-canary.21](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.20...v1.0.0-canary.21) (2026-06-11)
 
 ### Bug Fixes

package/README.md

@@ -103,7 +103,7 @@ For iOS integration, make sure that:
 At runtime, the app must provide the native side with the master key, identify the HD root key stored in MMKV, and keep the iOS identity store in sync:
 
 ```typescript
-await ReactNativePasskeyAutofill.setMasterKey(masterKeyHex);
+await ReactNativePasskeyAutofill.setMasterKey(masterKeyBytes);
 await ReactNativePasskeyAutofill.setHdRootKeyId(hdRootKeyId);
 await ReactNativePasskeyAutofill.refreshCredentialIdentities();
 ```
@@ -115,8 +115,9 @@ Call `refreshCredentialIdentities()` after creating, importing, deleting, or res
 ```typescript
 import ReactNativePasskeyAutofill from "@algorandfoundation/react-native-passkey-autofill";
 
-// 1. Set the master key for encryption (hex string)
-await ReactNativePasskeyAutofill.setMasterKey(masterKeyHex);
+// 1. Set the master key for encryption (raw bytes — never a hex string, so
+//    the secret isn't materialized as a non-zeroable JS string)
+await ReactNativePasskeyAutofill.setMasterKey(masterKeyBytes);
 
 // 2. Set the HD root key ID if applicable
 await ReactNativePasskeyAutofill.setHdRootKeyId(hdRootKeyId);

package/android/src/main/java/co/algorand/passkeyautofill/ReactNativePasskeyAutofillModule.kt

@@ -45,7 +45,7 @@ class ReactNativePasskeyAutofillModule : Module() {
 
     Events("onPasskeyAdded", "onPasskeyAuthenticated")
 
-    AsyncFunction("setMasterKey") { secret: String ->
+    AsyncFunction("setMasterKey") { secret: ByteArray ->
       val context = (appContext.reactContext ?: appContext.hostingRuntimeContext) as? Context
       if (context != null) {
         credentialRepository.saveMasterKey(context, secret)

package/android/src/main/java/co/algorand/passkeyautofill/credentials/CredentialRepository.kt

@@ -39,7 +39,7 @@ interface CredentialRepository {
     fun getPublicKeyFromKeyPair(keyPair: KeyPair?): ByteArray
     fun sign(keyPair: KeyPair, payload: ByteArray): ByteArray
     fun isMasterKeyAvailable(context: Context): Boolean
-    fun saveMasterKey(context: Context, secret: String)
+    fun saveMasterKey(context: Context, secret: ByteArray)
     fun saveHdRootKeyId(context: Context, id: String)
     fun getHdRootKeyId(context: Context): String?
     fun configureIntentActions(context: Context, getPasskeyAction: String, createPasskeyAction: String)
@@ -450,22 +450,11 @@ class Repository() : CredentialRepository {
         }
     }
 
-    override fun saveMasterKey(context: Context, secret: String) {
-        
-        // Convert hex string to bytes if it's a valid hex string of appropriate length
-        val keyBytes = try {
-            if ((secret.length == 64 || secret.length == 32) && secret.all { it in '0'..'9' || it in 'a'..'f' || it in 'A'..'F' }) {
-                hexToBytes(secret.trim())
-            } else {
-                secret.toByteArray(Charsets.UTF_8)
-            }
-        } catch (e: Exception) {
-            secret.toByteArray(Charsets.UTF_8)
-        }
-
-        // Store in our separate Keychain for persistence
+    override fun saveMasterKey(context: Context, secret: ByteArray) {
+        // The master key arrives as raw bytes (the bridge no longer takes a hex
+        // String), so encrypt it straight into the Keychain.
         try {
-            encryptToKeychain(context, keyBytes)
+            encryptToKeychain(context, secret)
         } catch (e: Exception) {
             Log.e(CredentialRepository.TAG, "Failed to save master key to Keychain", e)
         }

package/app.plugin.js

@@ -45,6 +45,12 @@ const getIosBundleIdentifier = (config) =>
 const getAppGroup = (config, props) =>
   props.appGroup || `group.${getIosBundleIdentifier(config)}.passkey-autofill`;
 
+// Keychain access-group *base* (without the `$(AppIdentifierPrefix)` team
+// prefix, which Xcode resolves at build time). Shared by the app and the
+// AutoFill extension so both can read the master key from the Keychain.
+const getKeychainGroup = (config, props) =>
+  props.keychainGroup || `${getIosBundleIdentifier(config)}.passkey-autofill`;
+
 const AAGUID_REGEX =
   /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 
@@ -149,6 +155,8 @@ const extensionInfoPlist = ({
   <string>$(PASSKEY_AUTOFILL_APP_GROUP)</string>
   <key>AppGroupIdentifier</key>
   <string>$(PASSKEY_AUTOFILL_APP_GROUP)</string>
+  <key>ReactNativePasskeyAutofillKeychainGroup</key>
+  <string>$(PASSKEY_AUTOFILL_KEYCHAIN_GROUP)</string>
 ${aaguid ? `  <key>ReactNativePasskeyAutofillAAGUID</key>\n  <string>${aaguid}</string>\n` : ""}  <key>${IOS_BIOMETRIC_INFO_PLIST_KEY}</key>
   <string>${biometricRequirement}</string>
   <key>NSFaceIDUsageDescription</key>
@@ -186,7 +194,10 @@ ${supportedDomains.map((domain) => `      <string>${domain}</string>`).join("\n"
 </plist>
 `;
 
-const extensionEntitlementsPlist = ({ appGroup }) => `<?xml version="1.0" encoding="UTF-8"?>
+const extensionEntitlementsPlist = ({
+  appGroup,
+  keychainGroup,
+}) => `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -196,6 +207,10 @@ const extensionEntitlementsPlist = ({ appGroup }) => `<?xml version="1.0" encodi
   <array>
     <string>${appGroup}</string>
   </array>
+  <key>keychain-access-groups</key>
+  <array>
+    <string>$(AppIdentifierPrefix)${keychainGroup}</string>
+  </array>
 </dict>
 </plist>
 `;
@@ -206,12 +221,14 @@ const withIosPasskeyAutofill = (config, props = {}) => {
   const associatedDomain = getAssociatedDomain(site);
   const supportedDomains = props.supportedDomains || [associatedDomain];
   const appGroup = getAppGroup(config, props);
+  const keychainGroup = getKeychainGroup(config, props);
   const aaguid = getAaguid(props);
   const biometricRequirement = getBiometricRequirement(props);
 
   config = withInfoPlist(config, (config) => {
     config.modResults.ReactNativePasskeyAutofillAppGroup = appGroup;
     config.modResults.AppGroupIdentifier = appGroup;
+    config.modResults.ReactNativePasskeyAutofillKeychainGroup = keychainGroup;
     return config;
   });
 
@@ -225,6 +242,10 @@ const withIosPasskeyAutofill = (config, props = {}) => {
     const appGroups = new Set(config.modResults["com.apple.security.application-groups"] || []);
     appGroups.add(appGroup);
     config.modResults["com.apple.security.application-groups"] = [...appGroups];
+
+    const keychainGroups = new Set(config.modResults["keychain-access-groups"] || []);
+    keychainGroups.add(`$(AppIdentifierPrefix)${keychainGroup}`);
+    config.modResults["keychain-access-groups"] = [...keychainGroups];
     return config;
   });
 
@@ -246,7 +267,7 @@ const withIosPasskeyAutofill = (config, props = {}) => {
       );
       writePlist(
         path.join(extensionRoot, `${IOS_EXTENSION_NAME}.entitlements`),
-        extensionEntitlementsPlist({ appGroup }),
+        extensionEntitlementsPlist({ appGroup, keychainGroup }),
       );
       return config;
     },
@@ -297,6 +318,7 @@ const withIosPasskeyAutofill = (config, props = {}) => {
         IPHONEOS_DEPLOYMENT_TARGET: "17.0",
         MARKETING_VERSION: `"${config.version || "1.0.0"}"`,
         PASSKEY_AUTOFILL_APP_GROUP: `"${appGroup}"`,
+        PASSKEY_AUTOFILL_KEYCHAIN_GROUP: `"${keychainGroup}"`,
         PRODUCT_BUNDLE_IDENTIFIER: `"${bundleIdentifier}"`,
         SWIFT_ACTIVE_COMPILATION_CONDITIONS: "PASSKEY_AUTOFILL_EXTENSION",
         HEADER_SEARCH_PATHS: [

package/build/ReactNativePasskeyAutofillModule.d.ts

@@ -1,7 +1,13 @@
 import { NativeModule } from "expo";
 import { PasskeyAutofillCredentialIdentity, ReactNativePasskeyAutofillModuleEvents } from "./ReactNativePasskeyAutofill.types";
 declare class ReactNativePasskeyAutofillModule extends NativeModule<ReactNativePasskeyAutofillModuleEvents> {
-    setMasterKey(secret: string): Promise<void>;
+    /**
+     * Persists the keystore master key as **raw bytes**, so a non-zeroable hex
+     * string is never materialized in the JS heap (immutable JS strings can't be
+     * wiped and linger until GC). The caller should zero the `Uint8Array` after
+     * the promise resolves.
+     */
+    setMasterKey(secret: Uint8Array): Promise<void>;
     setHdRootKeyId(id: string): Promise<void>;
     getHdRootKeyId(): Promise<string | null>;
     configureIntentActions(getPasskeyAction: string, createPasskeyAction: string): Promise<void>;

package/build/ReactNativePasskeyAutofillModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofillModule.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAGzD,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACvC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,OAAO,gCAAiC,SAAQ,YAAY,CAAC,sCAAsC,CAAC;IACzG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IACxC,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5F,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IACjC,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACrD;;;;;OAKG;IACH,oBAAoB,IAAI,OAAO,CAAC,iCAAiC,EAAE,CAAC;IACpE;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IACnC;;;;;;;OAOG;IACH,2BAA2B,CAAC,WAAW,EAAE,iCAAiC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5F,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5C;;;;;;OAMG;IACH,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IACpC;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;CACzC;AAGD,QAAA,MAAM,YAAY,kCAEjB,CAAC;AAoBF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"ReactNativePasskeyAutofillModule.d.ts","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAGzD,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACvC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,OAAO,gCAAiC,SAAQ,YAAY,CAAC,sCAAsC,CAAC;IACzG;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAC/C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IACxC,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5F,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IACjC,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACrD;;;;;OAKG;IACH,oBAAoB,IAAI,OAAO,CAAC,iCAAiC,EAAE,CAAC;IACpE;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IACnC;;;;;;;OAOG;IACH,2BAA2B,CAAC,WAAW,EAAE,iCAAiC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5F,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5C;;;;;;OAMG;IACH,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IACpC;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;CACzC;AAGD,QAAA,MAAM,YAAY,kCAEjB,CAAC;AAoBF,eAAe,YAAY,CAAC"}

package/build/ReactNativePasskeyAutofillModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"ReactNativePasskeyAutofillModule.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAoDxC,yDAAyD;AACzD,MAAM,YAAY,GAAG,mBAAmB,CACtC,4BAA4B,CAC7B,CAAC;AAEF,6EAA6E;AAC7E,uEAAuE;AACvE,wEAAwE;AACxE,uCAAuC;AACvC,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;IAC9B,MAAM,KAAK,GAA6D;QACtE,2BAA2B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACpD,2BAA2B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACpD,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,OAAQ,YAAmD,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACpF,YAAmD,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,eAAe,YAAY,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\nimport { Platform } from \"react-native\";\n\nimport {\n  PasskeyAutofillCredentialIdentity,\n  ReactNativePasskeyAutofillModuleEvents,\n} from \"./ReactNativePasskeyAutofill.types\";\n\ndeclare class ReactNativePasskeyAutofillModule extends NativeModule<ReactNativePasskeyAutofillModuleEvents> {\n  setMasterKey(secret: string): Promise<void>;\n  setHdRootKeyId(id: string): Promise<void>;\n  getHdRootKeyId(): Promise<string | null>;\n  configureIntentActions(getPasskeyAction: string, createPasskeyAction: string): Promise<void>;\n  clearCredentials(): Promise<void>;\n  deleteCredential(credentialId: string): Promise<void>;\n  /**\n   * iOS: returns the identities currently published to the AutoFill\n   * `ASCredentialIdentityStore`. Android: no-op returning `[]` because the\n   * native Credential Provider service reads credentials directly from MMKV\n   * and there is no separate identity store to query.\n   */\n  getStoredCredentials(): Promise<PasskeyAutofillCredentialIdentity[]>;\n  /**\n   * iOS: returns diagnostic strings from the AutoFill extension.\n   * Android: no-op returning `[]`.\n   */\n  getDiagnostics(): Promise<string[]>;\n  /**\n   * Replaces the iOS AutoFill passkey identity store with credentials\n   * available to the native Credential Provider extension. Each item must\n   * include a credential id, relying party (`relyingPartyIdentifier`,\n   * `rpId`, or `origin`), user handle, and P-256 private key material.\n   * Android ignores this method (no-op) because the provider reads MMKV\n   * directly.\n   */\n  replaceCredentialIdentities(credentials: PasskeyAutofillCredentialIdentity[]): Promise<void>;\n  refreshCredentialIdentities(): Promise<void>;\n  /**\n   * Resolves to `true` when this app is registered as the active\n   * credential/autofill provider on the current device (Android 14+\n   * credential provider or iOS AutoFill). Useful for gating passkey UI\n   * and for E2E tests that need to confirm the prompt that appears\n   * belongs to this provider and not a third party.\n   */\n  isProviderActive(): Promise<boolean>;\n  /**\n   * Opens the OS credential/autofill provider settings screen so the\n   * user can enable this app as the active provider. Resolves to `true`\n   * if a settings screen could be launched, `false` otherwise.\n   */\n  openProviderSettings(): Promise<boolean>;\n}\n\n// This call loads the native module object from the JSI.\nconst nativeModule = requireNativeModule<ReactNativePasskeyAutofillModule>(\n  \"ReactNativePasskeyAutofill\",\n);\n\n// A handful of methods are only implemented in the iOS native module because\n// they interact with `ASCredentialIdentityStore`, which has no Android\n// equivalent (the Android Credential Provider service reads credentials\n// directly from MMKV on each request).\nif (Platform.OS === \"android\") {\n  const noops: Record<string, (...args: unknown[]) => Promise<unknown>> = {\n    replaceCredentialIdentities: () => Promise.resolve(),\n    refreshCredentialIdentities: () => Promise.resolve(),\n    getStoredCredentials: () => Promise.resolve([]),\n    getDiagnostics: () => Promise.resolve([]),\n  };\n  for (const name of Object.keys(noops)) {\n    if (typeof (nativeModule as unknown as Record<string, unknown>)[name] !== \"function\") {\n      (nativeModule as unknown as Record<string, unknown>)[name] = noops[name];\n    }\n  }\n}\n\nexport default nativeModule;\n"]}
+{"version":3,"file":"ReactNativePasskeyAutofillModule.js","sourceRoot":"","sources":["../src/ReactNativePasskeyAutofillModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AA0DxC,yDAAyD;AACzD,MAAM,YAAY,GAAG,mBAAmB,CACtC,4BAA4B,CAC7B,CAAC;AAEF,6EAA6E;AAC7E,uEAAuE;AACvE,wEAAwE;AACxE,uCAAuC;AACvC,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;IAC9B,MAAM,KAAK,GAA6D;QACtE,2BAA2B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACpD,2BAA2B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACpD,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,OAAQ,YAAmD,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACpF,YAAmD,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,eAAe,YAAY,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\nimport { Platform } from \"react-native\";\n\nimport {\n  PasskeyAutofillCredentialIdentity,\n  ReactNativePasskeyAutofillModuleEvents,\n} from \"./ReactNativePasskeyAutofill.types\";\n\ndeclare class ReactNativePasskeyAutofillModule extends NativeModule<ReactNativePasskeyAutofillModuleEvents> {\n  /**\n   * Persists the keystore master key as **raw bytes**, so a non-zeroable hex\n   * string is never materialized in the JS heap (immutable JS strings can't be\n   * wiped and linger until GC). The caller should zero the `Uint8Array` after\n   * the promise resolves.\n   */\n  setMasterKey(secret: Uint8Array): Promise<void>;\n  setHdRootKeyId(id: string): Promise<void>;\n  getHdRootKeyId(): Promise<string | null>;\n  configureIntentActions(getPasskeyAction: string, createPasskeyAction: string): Promise<void>;\n  clearCredentials(): Promise<void>;\n  deleteCredential(credentialId: string): Promise<void>;\n  /**\n   * iOS: returns the identities currently published to the AutoFill\n   * `ASCredentialIdentityStore`. Android: no-op returning `[]` because the\n   * native Credential Provider service reads credentials directly from MMKV\n   * and there is no separate identity store to query.\n   */\n  getStoredCredentials(): Promise<PasskeyAutofillCredentialIdentity[]>;\n  /**\n   * iOS: returns diagnostic strings from the AutoFill extension.\n   * Android: no-op returning `[]`.\n   */\n  getDiagnostics(): Promise<string[]>;\n  /**\n   * Replaces the iOS AutoFill passkey identity store with credentials\n   * available to the native Credential Provider extension. Each item must\n   * include a credential id, relying party (`relyingPartyIdentifier`,\n   * `rpId`, or `origin`), user handle, and P-256 private key material.\n   * Android ignores this method (no-op) because the provider reads MMKV\n   * directly.\n   */\n  replaceCredentialIdentities(credentials: PasskeyAutofillCredentialIdentity[]): Promise<void>;\n  refreshCredentialIdentities(): Promise<void>;\n  /**\n   * Resolves to `true` when this app is registered as the active\n   * credential/autofill provider on the current device (Android 14+\n   * credential provider or iOS AutoFill). Useful for gating passkey UI\n   * and for E2E tests that need to confirm the prompt that appears\n   * belongs to this provider and not a third party.\n   */\n  isProviderActive(): Promise<boolean>;\n  /**\n   * Opens the OS credential/autofill provider settings screen so the\n   * user can enable this app as the active provider. Resolves to `true`\n   * if a settings screen could be launched, `false` otherwise.\n   */\n  openProviderSettings(): Promise<boolean>;\n}\n\n// This call loads the native module object from the JSI.\nconst nativeModule = requireNativeModule<ReactNativePasskeyAutofillModule>(\n  \"ReactNativePasskeyAutofill\",\n);\n\n// A handful of methods are only implemented in the iOS native module because\n// they interact with `ASCredentialIdentityStore`, which has no Android\n// equivalent (the Android Credential Provider service reads credentials\n// directly from MMKV on each request).\nif (Platform.OS === \"android\") {\n  const noops: Record<string, (...args: unknown[]) => Promise<unknown>> = {\n    replaceCredentialIdentities: () => Promise.resolve(),\n    refreshCredentialIdentities: () => Promise.resolve(),\n    getStoredCredentials: () => Promise.resolve([]),\n    getDiagnostics: () => Promise.resolve([]),\n  };\n  for (const name of Object.keys(noops)) {\n    if (typeof (nativeModule as unknown as Record<string, unknown>)[name] !== \"function\") {\n      (nativeModule as unknown as Record<string, unknown>)[name] = noops[name];\n    }\n  }\n}\n\nexport default nativeModule;\n"]}

package/ios/AutofillCredentialProvider/PasskeyCredentialStore.swift

@@ -35,6 +35,10 @@ final class PasskeyCredentialStore {
   static let defaultCreatePasskeyActionKey = "ReactNativePasskeyAutofillCreatePasskeyAction"
   static let defaultDiagnosticsKey = "ReactNativePasskeyAutofillDiagnostics"
   static let defaultDeletedCredentialIdsKey = "ReactNativePasskeyAutofillDeletedCredentialIds"
+  /// Info.plist key holding the keychain access-group *base* (without the team
+  /// prefix) shared by the app and the AutoFill extension. Injected by the
+  /// config plugin so the module stays team-agnostic.
+  static let keychainGroupInfoKey = "ReactNativePasskeyAutofillKeychainGroup"
 
   private let defaults: UserDefaults
   private let credentialKey: String
@@ -248,23 +252,126 @@ final class PasskeyCredentialStore {
     defaults.removeObject(forKey: Self.defaultHdRootKeyIdKey)
     defaults.removeObject(forKey: Self.defaultGetPasskeyActionKey)
     defaults.removeObject(forKey: Self.defaultCreatePasskeyActionKey)
-  }
-
-  func saveMasterKey(_ secret: String) {
-    defaults.set(Self.normalizeSecret(secret).base64URLEncodedString(), forKey: Self.defaultMasterKeyKey)
+    if let query = masterKeyQuery() {
+      _ = SecItemDelete(query as CFDictionary)
+    }
+  }
+
+  // MARK: - Master key (Keychain-backed)
+  //
+  // The master key is the KEK for the credential store and is read by *both*
+  // the app and the AutoFill extension. It is stored in the Keychain (encrypted
+  // at rest, hardware-backed) in a shared access group so both processes can
+  // read it — never in plaintext UserDefaults. Accessibility is
+  // `AfterFirstUnlockThisDeviceOnly`, NOT biometric: the extension must read the
+  // key to *enumerate* credentials before the user authenticates, so a
+  // biometric-gated item would break the AutoFill list. Biometric checks stay at
+  // the assertion step (`LAContext` in `CredentialProviderViewController`).
+
+  func saveMasterKey(_ secret: Data) {
+    guard var query = masterKeyQuery() else { return }
+    // Upsert: drop any existing value, then add the new one.
+    _ = SecItemDelete(query as CFDictionary)
+    query[kSecValueData as String] = secret
+    query[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+    _ = SecItemAdd(query as CFDictionary, nil)
+    // Scrub any legacy plaintext copy now that the Keychain holds the key.
+    defaults.removeObject(forKey: Self.defaultMasterKeyKey)
   }
 
   func masterKey() -> Data? {
-    guard let secret = defaults.string(forKey: Self.defaultMasterKeyKey) else {
-      return nil
+    if var query = masterKeyQuery() {
+      query[kSecReturnData as String] = true
+      query[kSecMatchLimit as String] = kSecMatchLimitOne
+      var item: CFTypeRef?
+      if SecItemCopyMatching(query as CFDictionary, &item) == errSecSuccess,
+         let data = item as? Data
+      {
+        return data
+      }
+    }
+    // Migration: older builds stored the key as plaintext in the App Group
+    // UserDefaults. Move it into the Keychain (and scrub the plaintext) once.
+    if let legacy = defaults.string(forKey: Self.defaultMasterKeyKey),
+       let data = Data(base64URLEncoded: legacy) ?? Data(base64Encoded: legacy)
+    {
+      saveMasterKey(data)
+      return data
     }
-    return Data(base64URLEncoded: secret) ?? Data(base64Encoded: secret)
+    return nil
   }
 
   func isMasterKeyAvailable() -> Bool {
     masterKey() != nil
   }
 
+  /// Base Keychain query identifying the shared master-key item. Returns `nil`
+  /// when the access group can't be resolved (no Info.plist group or no team
+  /// prefix), in which case the caller falls back / no-ops rather than writing
+  /// to the wrong place.
+  private func masterKeyQuery() -> [String: Any]? {
+    guard let accessGroup = masterKeyAccessGroup() else { return nil }
+    return [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrService as String: Self.defaultMasterKeyKey,
+      kSecAttrAccount as String: Self.defaultMasterKeyKey,
+      kSecAttrAccessGroup as String: accessGroup,
+    ]
+  }
+
+  /// The full keychain access group (`<TeamID>.<base>`). The base is injected by
+  /// the config plugin via Info.plist; the team prefix is resolved at runtime.
+  private func masterKeyAccessGroup() -> String? {
+    guard
+      let base = Bundle.main.object(forInfoDictionaryKey: Self.keychainGroupInfoKey) as? String,
+      let prefix = Self.keychainTeamPrefix()
+    else {
+      return nil
+    }
+    return prefix + base
+  }
+
+  private static var cachedTeamPrefix: String?
+
+  /// Resolves the app's keychain access-group team prefix (`<TeamID>.`) at
+  /// runtime by probing a throwaway Keychain item and reading back the group the
+  /// system assigns. Avoids hardcoding a team ID in a module shared across teams.
+  private static func keychainTeamPrefix() -> String? {
+    if let cached = cachedTeamPrefix {
+      return cached
+    }
+    let probeAccount = "ReactNativePasskeyAutofillTeamPrefixProbe"
+    let cleanup: [String: Any] = [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrAccount as String: probeAccount,
+    ]
+    _ = SecItemDelete(cleanup as CFDictionary)
+
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassGenericPassword,
+      kSecAttrAccount as String: probeAccount,
+      kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
+      kSecValueData as String: Data(),
+      kSecReturnAttributes as String: true,
+    ]
+    var result: CFTypeRef?
+    let status = SecItemAdd(query as CFDictionary, &result)
+    defer { _ = SecItemDelete(cleanup as CFDictionary) }
+
+    guard
+      status == errSecSuccess,
+      let attributes = result as? [String: Any],
+      let accessGroup = attributes[kSecAttrAccessGroup as String] as? String,
+      let dotIndex = accessGroup.firstIndex(of: ".")
+    else {
+      return nil
+    }
+    // accessGroup is "<TeamID>.<something>"; keep through the first dot.
+    let prefix = String(accessGroup[...dotIndex])
+    cachedTeamPrefix = prefix
+    return prefix
+  }
+
   func saveHdRootKeyId(_ id: String) {
     defaults.set(id, forKey: Self.defaultHdRootKeyIdKey)
   }
@@ -360,17 +467,6 @@ final class PasskeyCredentialStore {
     }
   }
 
-  private static func normalizeSecret(_ secret: String) -> Data {
-    let trimmed = secret.trimmingCharacters(in: .whitespacesAndNewlines)
-    if trimmed.count % 2 == 0,
-       trimmed.allSatisfy({ $0.isHexDigit }),
-       let data = Data(hex: trimmed)
-    {
-      return data
-    }
-    return Data(trimmed.utf8)
-  }
-
   private func credentialIdCandidates(_ id: String) -> Set<String> {
     var candidates: Set<String> = [id]
     if let data = Data(base64URLEncoded: id) ?? Data(base64Encoded: id) {

package/ios/ReactNativePasskeyAutofillModule.swift

@@ -16,7 +16,7 @@ public class ReactNativePasskeyAutofillModule: Module {
 
     Events("onPasskeyAdded", "onPasskeyAuthenticated")
 
-    AsyncFunction("setMasterKey") { (secret: String) in
+    AsyncFunction("setMasterKey") { (secret: Data) in
       guard let store = PasskeyCredentialStore() else {
         throw NSError(
           domain: "ReactNativePasskeyAutofill",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algorandfoundation/react-native-passkey-autofill",
-  "version": "1.0.0-canary.21",
+  "version": "1.0.0-canary.22",
   "description": "Passkey AutoFill React Native",
   "keywords": [
     "@algorandfoundation/react-native-passkey-autofill",

package/src/ReactNativePasskeyAutofillModule.ts

@@ -7,7 +7,13 @@ import {
 } from "./ReactNativePasskeyAutofill.types";
 
 declare class ReactNativePasskeyAutofillModule extends NativeModule<ReactNativePasskeyAutofillModuleEvents> {
-  setMasterKey(secret: string): Promise<void>;
+  /**
+   * Persists the keystore master key as **raw bytes**, so a non-zeroable hex
+   * string is never materialized in the JS heap (immutable JS strings can't be
+   * wiped and linger until GC). The caller should zero the `Uint8Array` after
+   * the promise resolves.
+   */
+  setMasterKey(secret: Uint8Array): Promise<void>;
   setHdRootKeyId(id: string): Promise<void>;
   getHdRootKeyId(): Promise<string | null>;
   configureIntentActions(getPasskeyAction: string, createPasskeyAction: string): Promise<void>;