API reference › @evolu/common › local‑first/Auth › DeviceSecret

const DeviceSecret: brand(
  "DeviceSecret",
  Entropy32,
  (value) =>
    value.some((byte) => byte !== 0)
      ? ok()
      : err<DeviceSecretError>({ type: "DeviceSecret" }),
  () =>
    "32 zero bytes are instant start's public secret, not a DeviceSecret. Create one with createDeviceSecret.",
);

Defined in: packages/common/src/local-first/Auth.ts:106

The secret of an app's device database, which keeps the AppOwners the app can open on this device. Keep it where only the user or the platform can unlock it, as loadDeviceSecret of @evolu/react-native does, or in Electron's safeStorage. It isn't an OwnerSecret: createEvoluApp derives the device database's owner from it on paths no OwnerSecret reaches, so no AppOwner's ID or keys name or open the device database. Create it with createDeviceSecret and never use its bytes as an OwnerSecret: an AppOwner's mnemonic is its secret, so whoever holds it would derive the device database's key. 32 zero bytes are instant start's public secret, so the Type rejects them, also in createEvoluApp, which checks the secret it gets with the Type.