---
title: "Keys and Storage"
description: "Learn how the Wallet SDK stores credentials and protects holder signing keys on Android and iOS."
stack: "Community Stack (open source) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/mobile-wallet/keys-and-storage
generated: 2026-10-01
---
# Keys and Storage

This guide shows you how to create a Wallet SDK instance, initialize a signing identity, and configure key-use authorization. The SDK stores credentials in an encrypted on-device database and keeps signing keys in the platform keystore.

[**Signing identity**](https://docs.walt.id/community-stack/mobile-wallet/backup-and-recovery.md): A P-256 holder key bound to a `did:jwk`, plus the policy that protects that key.

## Prerequisites

Before you begin, ensure you have:

- **The Wallet SDK on your platform** — Follow [Integrate the SDK](https://docs.walt.id/community-stack/mobile-wallet/integrate-the-sdk.md) for library setup.
- **A resumed Android `FragmentActivity`** — Required for each protected signing prompt on Android.
- **`NSFaceIDUsageDescription` on iOS** — Required for biometric signing.

---

## Create a Wallet

`walletId` / `walletID` is an application-level identity. Treat it as stable: it names the encrypted database and related key material.

**Option: Kotlin**

```kotlin
val config = MobileWalletConfig(walletId = "consumer-wallet")
val wallet = MobileWalletFactory(context).create(config)
```

**Option: Swift**

```swift
import WalletSDK

let wallet = try await Wallet(
    configuration: WalletConfiguration(
        walletID: "consumer-wallet",
        defaultKeyUseAuthorizationPolicy: .biometricCurrentSet,
        keyUseAuthorizationPrompt: WalletKeyUseAuthorizationPrompt(
            message: "Authorize wallet signing",
            cancelText: "Cancel"
        )
    )
)
```

Default persistence is encrypted SQLDelight with SQLCipher. The SDK generates a database key, stores it in platform-protected storage, and does not fall back to plaintext. Signing keys always remain platform-managed. You can override credential or DID stores independently if your app owns that durability.

## Signing Identity

Call `signingIdentity.initialize()` before issuance or presentation that needs holder keys. New identities use P-256 and `did:jwk`.

**Option: Kotlin**

```kotlin
when (val result = wallet.signingIdentity.initialize()) {
    is SigningIdentityOperationResult.Active -> openWallet(result.identity)
    is SigningIdentityOperationResult.Pending -> showPendingSetup(result.identityId)
    is SigningIdentityOperationResult.Failed -> showFailure(result.reason)
}
```

**Option: Swift**

```swift
guard case .active(let identity) = try await wallet.signingIdentity.initialize() else {
    return
}
print(identity.did)
```

🎉 You've created a wallet with an active signing identity.

List stored credentials with `wallet.credentials()` and remove one with `wallet.deleteCredential(id)`.

## Key-Use Authorization

New keys default to **biometric current set**: strong biometrics, no device-credential fallback, P-256. Restored keys keep the policy they were created with. Changing the wallet default never weakens an existing key.

- **Biometric current set** — Invalidates the key when the biometric enrollment set changes. Requires a physical Secure Enclave device for hardware signing on iOS.
- **Biometric timed reuse** — A 1–30 second reuse window after successful strong-biometric authorization. This is recent platform authentication, not consent for a wallet action.
- **None** — Unprotected signing. Select it explicitly when you need it.

Call `keyUseAuthorizationPreflight` to check whether a policy is supported before creating a key.

**Error:**

Timed biometric reuse does not replace holder consent for issuance or presentation. Collect consent in your UI, then let the SDK authorize the key.

Optional `attestationConfig` / `WalletConfiguration.attestation` supplies OAuth client attestation when an issuer requires it.

## Next Steps

- **Back up the signing identity** — [Backup and Recovery](https://docs.walt.id/community-stack/mobile-wallet/backup-and-recovery.md).
- **Separate app unlock from signing policy** — [Security](https://docs.walt.id/community-stack/mobile-wallet/security.md).
- **Run your first holder flow** — [Integrate the SDK](https://docs.walt.id/community-stack/mobile-wallet/integrate-the-sdk.md).