Skip to content
Docs · Multi-device identity

Holochain multi-device identity

Holochain gives every device its own agent key and has no way to say two keys are one person. hApp Auth binds a person’s keys to their account and, with their consent, tells one network that two of its keys are the same person.

ComingShips after sign-in for websites. This page describes it as designed; details can change before it ships.

The gap

Core has no multi-device identity: DPKI was removed in 0.6, and one key per device is enforced by fork warrants. A person with a laptop and a phone is two agents to every network they join. hApp Auth is the join that is missing, and it never holds a key to make it.

Binding a key

  1. In a hApp that ships the happ_auth zome, the person presses Link to hApp Auth.
  2. The UI fetches a bind challenge; the zome signs it (it builds the bytes itself, see the signed bytes); the browser opens happauth.com with the signed challenge.
  3. The person signs in with a passkey, names the device (“laptop”, “phone”) and confirms.

A binding is a row: account, agent key, DNA hash, label, created, revoked. It is opt-in per key and revocable from the account page.

Same person, per network

Asked once per network: “Let this network know your devices are the same person?” Yes issues each bound key an agent-bound attestation carrying a pairwise account id for that DNA. Two keys in one network with the same pairwise id are the same person. Nothing correlates them across networks.

On a website

A site asks for the happ:agents scope and names the networks (DNA hashes) it cares about. The person ticks which ones to share; the site receives the keys bound in those networks and their pairwise id, never the person’s full key list.

Rules

  • We never hold, generate, back up or escrow an agent key or seed.
  • If the account was recovered by email in the last seven days, binding waits until the hold ends.
  • Any DNA code we ship that writes entries checks, on every create, update and delete, that the author is the agent the entry names. Forged same-person links, revocation by anyone and profile overwrite by anyone are negative tests in our suite.
Admission is a separate step

A binding says who a key belongs to. Whether a network admits that key is the network’s rule, checked by its own code: see Holochain membrane proofs.