Blocks the fourth backup method from #147. Everything else in that issue shipped; this one cannot
start, and the blocker is procurement rather than code.
What is blocked
Saving a recovery phrase into the platform credential manager — Google Password Manager on
Android, iCloud Keychain on iOS, and Bitwarden/1Password/Proton via the credential-provider API.
It is the highest-leverage option for a non-crypto user, because it is the only one that survives
losing the phone and requires no comprehension of what a key is. Loopky currently offers a
recovery phrase, an encrypted file, and export to Pubky Ring — all of which ask the user to
understand and then do something.
The prerequisite
A domain Loopky controls, serving:
/.well-known/assetlinks.json — Digital Asset Links, containing the release signing
certificate's SHA-256. Android's CredentialManager will not associate credentials without it./.well-known/apple-app-site-association — with a webcredentials section for the iOS bundle
id, paired with the com.apple.developer.associated-domains entitlement in the app.
Both are prerequisites, not details, and both platforms need the same domain.
Then the code
Copy constraints
Frame it as "Save your recovery phrase to your password manager", never "set a password" — this
is storing a master key, and the phrasing should not disguise that. Keep it beside the other three
methods rather than making it the default: it is the most convenient and the least sovereign, which
is the tradeoff to state rather than hide. Re-warn when the phrase being saved was restored
rather than created here, since that is a step that copies it somewhere new.
Related: #147, #149.
🤖 Generated with Claude Code
Blocks the fourth backup method from #147. Everything else in that issue shipped; this one cannot
start, and the blocker is procurement rather than code.
What is blocked
Saving a recovery phrase into the platform credential manager — Google Password Manager on
Android, iCloud Keychain on iOS, and Bitwarden/1Password/Proton via the credential-provider API.
It is the highest-leverage option for a non-crypto user, because it is the only one that survives
losing the phone and requires no comprehension of what a key is. Loopky currently offers a
recovery phrase, an encrypted file, and export to Pubky Ring — all of which ask the user to
understand and then do something.
The prerequisite
A domain Loopky controls, serving:
/.well-known/assetlinks.json— Digital Asset Links, containing the release signingcertificate's SHA-256. Android's
CredentialManagerwill not associate credentials without it./.well-known/apple-app-site-association— with awebcredentialssection for the iOS bundleid, paired with the
com.apple.developer.associated-domainsentitlement in the app.Both are prerequisites, not details, and both platforms need the same domain.
Then the code
androidx.credentials—CreatePasswordRequest(id = "pubky:<short pubky>", password = <phrase>),plus a
GetPasswordOptionread path added as a fourth option on the restore screen.Copy constraints
Frame it as "Save your recovery phrase to your password manager", never "set a password" — this
is storing a master key, and the phrasing should not disguise that. Keep it beside the other three
methods rather than making it the default: it is the most convenient and the least sovereign, which
is the tradeoff to state rather than hide. Re-warn when the phrase being saved was restored
rather than created here, since that is a step that copies it somewhere new.
Related: #147, #149.
🤖 Generated with Claude Code