Docs / Security / Identity, devices and recovery
Identity, devices and recovery
Your key, where it lives and how to get it back.
Your identity is an X25519 key pair derived from a 24-word recovery phrase with HKDF-SHA-256. The phrase is generated on your device and is never sent to StoreEnv.
Where the private key lives
- CLI on macOS: encrypted on disk under a device key in the Keychain.
- CLI on Linux: the system keyring when secret-tool exists, otherwise a 0600 key file. Set STOREENV_PASSPHRASE to use a passphrase.
- Browser: encrypted under a WebCrypto key that page scripts can use but can't read.
Adding a device
The new device shows a short code. An enrolled device confirms the code and sends the private key sealed to the new device's one-time key.
$ storeenv device approve 7KQ2-MX
Recovery
With the phrase, run storeenv recover. Without the phrase and without any device, your encrypted data can't be recovered. Teammates can share project secrets with a new identity.