Skip to main content
Beta — BRC wallet only. Desktop / Mobile over BRC-100.
The wallet holds the keys. Your app names a protocol and a key ID, and the wallet derives a key for that context, uses it, and returns the result. No private key ever leaves the wallet. Every cryptographic call takes the same three fields: Use 'anyone' when third parties must verify the result, 'self' for records only your app and user read, and a specific key for pairwise data.

Read the identity key

This is the user’s stable identity across apps. Use it as the account handle in your backend.

Derive an app-scoped key

Publish this public key with your data so anyone can verify signatures later.

Sign and verify data

Sign a hash instead of the payload when the data is large or private:
Each signature is its own prompt. Batch what you can into one signed document rather than asking the user repeatedly.

Encrypt a record

Store the ciphertext wherever you like — your server can hold data it cannot read.

Authenticate a record with HMAC

Encryption gives confidentiality; HMAC gives integrity. Use the one you actually need, not both by reflex.

Certificates

Acquisition depends on your certifier’s BRC-52 flow. Once the user holds a certificate, reading and disclosing it is portable:
proveCertificate prompts with the exact fields being revealed, so request the fewest that your check requires.

Discover identities

Results are certificates other parties hold, not wallet contents. Treat them as claims that are only as good as their certifier.

Next steps