[API reference](https://evolu.dev/docs/api-reference) › [@evolu/common](https://evolu.dev/docs/api-reference/common) › [local‑first/Auth](https://evolu.dev/docs/api-reference/common/local-first/Auth) › DeviceSecretKeyProvider

Defined in: [packages/common/src/local-first/Auth.ts:175](https://github.com/evoluhq/evolu/blob/aa223771feea747ffb1b0f5f3271574455633e37/packages/common/src/local-first/Auth.ts#L175)

A source of the key that wraps an app's [DeviceSecret](https://evolu.dev/docs/api-reference/common/local-first/Auth/variables/DeviceSecret), such as a
passkey's PRF output, which `@evolu/web` provides. Creating or getting a key
may prompt the user, which some browsers allow only in a user gesture. Its
Tasks must end when their Run aborts them, such as by passing its signal to
the prompt, because a setup holds the app's lock while it creates or gets a
key, so a Task that keeps waiting holds up every tab's unlock. See
[unlockWrappedDeviceSecret](https://evolu.dev/docs/api-reference/common/local-first/Evolu/functions/unlockWrappedDeviceSecret).

## Properties

<a id="createkey"></a>

### createKey

```ts
readonly createKey: Task<Uint8Array<ArrayBufferLike> & Brand<"MaxLength1023"> & Brand<"MinLength1"> & Brand<"DeviceSecretKeyId">, DeviceSecretKeyError>;
```

Defined in: [packages/common/src/local-first/Auth.ts:177](https://github.com/evoluhq/evolu/blob/aa223771feea747ffb1b0f5f3271574455633e37/packages/common/src/local-first/Auth.ts#L177)

Creates a key and returns its id, which Evolu stores.

---

<a id="getkey"></a>

### getKey

```ts
readonly getKey: (id: Uint8Array<ArrayBufferLike> & Brand<"MaxLength1023"> & Brand<"MinLength1"> & Brand<"DeviceSecretKeyId">) => Task<Uint8Array<ArrayBufferLike> & Brand<"Entropy"> & Brand<"Length32">, DeviceSecretKeyError>;
```

Defined in: [packages/common/src/local-first/Auth.ts:180](https://github.com/evoluhq/evolu/blob/aa223771feea747ffb1b0f5f3271574455633e37/packages/common/src/local-first/Auth.ts#L180)

Gets the key with the id. The same id always gives the same key.