Your identity is an X25519 key pair derived from a 24-word recovery phrase with HKDF-SHA-256. The phrase is generated on your device and is never sent to StoreEnv.

Where the private key lives#

• CLI on macOS: encrypted on disk under a device key in the Keychain.
• CLI on Linux: the system keyring when secret-tool exists, otherwise a 0600 key file. Set STOREENV_PASSPHRASE to use a passphrase.
• Browser: encrypted under a WebCrypto key that page scripts can use but can't read.

Adding a device#

The new device shows a code and a device key. An enrolled device checks both and sends the private key sealed to the new device's one-time key.

$ storeenv device approve 7KQ2-MX --device-key SE:90FF-F3CE-12D8

Recovery#

With the phrase, run storeenv recover. Without the phrase and without any device, your encrypted data can't be recovered. Teammates can share project secrets with a new identity.