‹ Device capabilities

Function

getHardwareSecurityLevel()

Where Android keeps new Keystore keys: StrongBox, the Trusted Execution Environment, or software. Always null on iOS.

Import

import { getHardwareSecurityLevel } from '@apexnative/keychain';

Usage

import { getHardwareSecurityLevel, HardwareSecurityLevel } from '@apexnative/keychain';

const level = await getHardwareSecurityLevel();
if (level === HardwareSecurityLevel.Software) {
  reportWeakDevice(); // an emulator, or a device without secure hardware
}

Signature

function getHardwareSecurityLevel(): Promise<HardwareSecurityLevel | null>;

ReturnsPromise<HardwareSecurityLevel | null>PromptNeverPlatformsiOSAndroid

Returns

The best place a new key can live on this device: 'strongbox' when the device has StrongBox, else where a key made in the TEE actually lives, 'tee' or 'software'. See HardwareSecurityLevel. null on iOS, where the Secure Enclave protects every item and there is nothing to choose.

The answer is measured once, with a short-lived probe key, and kept. It is what the device offers, not where a given item's key is: that one is android.securityLevel in getItemInfo, and depends on the item's keyStorage too.

See also

KeyStorageWhere an item's key is asked to live.On AndroidHow the package uses the Keystore.