The Key Store service provides a secure flow for creating, recovering, and changing user PIN codes and managing encrypted key pairs. It is designed for implementing end-to-end encrypted user data and PIN-protected flows.
Key Architectural Principles:
- Private Key: Generated on the user's device and never stored on Buildfire servers. Developers must store this locally on the device.
- Encrypted Private Key: The private key is encrypted using a key derived from the user's PIN and stored on the Buildfire server. It can only be decrypted with the correct PIN.
- Public Key: Stored on the server and accessible at any time.
- PIN Recovery: Buildfire does not know the user's PIN. If a user resets their PIN, a brand new key pair is generated, and any data encrypted with the previous key becomes permanently unreadable.
Constraint: This service is not available on HTTP domains. You must use HTTPS, the Buildfire Previewer, or production app builds.