Mobile readiness

Shared2FA approvals feel like an authenticator app for every team credential handoff.

Search shared accounts, unlock on this device, approve or deny requests, and keep every decision in the same vault, audit, and MCP/CLI policy model. Installable web is available now; physical iOS/Android push, biometric approval, and packaged macOS proof stay explicit launch gates.

Search shared authenticator accounts

Available in web

Unlock with Face ID, Touch ID, or device biometric

Native proof pending

Approve or deny Shared2FA requests

Web proof green

Sync audit trail across web, CLI, and MCP

Policy model ready

Start workspace View plans

SecretSeal mobile

Vault, Send, Receive, Shared 2FA

metadata first

Search shared account

Unlock device

Approve Shared2FA request

Record audit decision

Available now

Installable web app

Use SecretSeal from mobile browsers with standalone app metadata and workspace shortcuts.

Home screen install metadata

Vault, Shared 2FA, and Send shortcuts

Responsive operator cockpit

App target scaffolded

iOS and Android

Expo app target consumes the shared approval model; production device QA, push receipt, and store packaging remain.

Shared approval inbox and detail screen

Face ID / Touch ID / device biometric prompt

Approve or deny sensitive reveals

Companion scaffolded

macOS companion

SwiftPM companion target reuses the same approval model for agent workflows, quick vault access, and local prompts.

Shared approval inbox detail model

SwiftUI approval window

MCP approval prompts

Authenticator-like flow

Simple for operators, strict about secrets.

SecretSeal should feel familiar like a team authenticator app while every reveal remains owner-aware, locally unlocked, and audited.

Find shared account

Search by issuer, account, client, or environment metadata without exposing seed.

Unlock on this device

Require local biometric or device unlock before any sensitive Shared2FA action.

Approve or deny

Review requester, system, rotation, and expiry context before code can be used.

Leave an audit trail

Record the decision in the same workspace policy and audit model used by web, CLI, and MCP.

Daily Shared2FA quick path

Operators should be able to open SecretSeal, find the shared account, approve the request, and leave an audit trail without seeing seeds or copying codes into chat.

Web now

Open SecretSeal

Use the installable web app today, then the same flow in native iOS, Android, and macOS clients after device proof.

Metadata only

Find the account

Search issuer, account, client, or environment metadata without showing a seed or generated code.

Approval gated

Approve the request

Review requester, expiry, workspace, and reason, then approve or deny without copying codes into chat.

Shared policy

Audit the decision

Keep the decision in the same vault, web, CLI, MCP, and mobile audit model.

Safe notification copy

Push should feel immediate like an authenticator prompt, but the lock screen only carries generic approval context.

Lock screen title

SecretSeal approval requested

Lock screen body

Open SecretSeal to review a Shared2FA request.

Deep-link context

Request id, workspace id, action type, and expiry; no account code or seed.

Authenticator parity drill

Web setup is available today. Native apps should complete the day-to-day approval loop with real-device push, biometric review, and packaged app proof.

Searchable accounts

Native view models and Expo UI can search issuer, account, client, and environment metadata without exposing seeds.

Authenticator import

Native setup-link preview reads safe metadata from otpauth links; QR camera capture and sealed vault creation still need production QA.

Account details

Native detail panels show safe issuer, account, review, rotation, and audit actions while edit/save remains gated.

Device migration

Native migration readiness shows active devices, pending approvals, sync time, and safe transfer steps without exporting secrets.

Push approvals

Safe push intents map to app-open approval screens; real native receipt and biometric approve/deny still need device QA.

Readiness status

Installability is live; native clients remain explicit roadmap.

The public web app exposes machine-checkable readiness at /api/mobile/readiness, native approval notification contract at /api/mobile/approval-contract, hashed device registration at /api/mobile/devices, plus an authenticated metadata-only approval queue at /api/mobile/approvals.

Repeatable native proof command

npm run native:proof:smoke

npm run native:launch-proof

npm run mobile:readiness:smoke

npm run mobile-approval:browser-source-smoke && npm run mobile-approval:browser-smoke

node scripts/native-package-source-smoke.mjs

npm --prefix packages/secretseal-native run smoke

npm run mobile:app:smoke

node scripts/macos-companion-source-smoke.mjs

npm run macos:app:build

npm run macos:app:test

Native launch proof handles

SECRETSEAL_IOS_PUSH_RECEIPT_PROOF=ios-device:<model>:<build>:<screenshot_or_runbook>

SECRETSEAL_IOS_BIOMETRIC_APPROVAL_PROOF=audit:<approve_event_or_runbook>

SECRETSEAL_IOS_BIOMETRIC_DENY_PROOF=audit:<deny_event_or_runbook>

SECRETSEAL_ANDROID_PUSH_RECEIPT_PROOF=android-device:<model>:<build>:<screenshot_or_runbook>

SECRETSEAL_ANDROID_BIOMETRIC_APPROVAL_PROOF=audit:<approve_event_or_runbook>

SECRETSEAL_ANDROID_BIOMETRIC_DENY_PROOF=audit:<deny_event_or_runbook>

SECRETSEAL_MACOS_SIGNED_PACKAGE_PROOF=macos-package:<signed_pkg_or_archive>

SECRETSEAL_MACOS_NOTARIZATION_PROOF=notary:<apple_notary_ticket_or_log>

SECRETSEAL_NATIVE_DISTRIBUTION_PROOF=distribution:<testflight_play_console_mdm_or_release_handle>

SECRETSEAL_NATIVE_VERIFIED_AT=<iso_timestamp>

Current native proof snapshot

native-authenticator-parity0/4 ready

Run physical iOS push notification approve and deny loops, then record ios-device: and approve/deny audit: handles.

SECRETSEAL_IOS_PUSH_RECEIPT_PROOFSECRETSEAL_IOS_BIOMETRIC_APPROVAL_PROOFSECRETSEAL_IOS_BIOMETRIC_DENY_PROOFSECRETSEAL_ANDROID_PUSH_RECEIPT_PROOFSECRETSEAL_ANDROID_BIOMETRIC_APPROVAL_PROOFSECRETSEAL_ANDROID_BIOMETRIC_DENY_PROOFSECRETSEAL_MACOS_SIGNED_PACKAGE_PROOFSECRETSEAL_MACOS_NOTARIZATION_PROOFSECRETSEAL_NATIVE_DISTRIBUTION_PROOFSECRETSEAL_NATIVE_VERIFIED_AT

Keep native Authenticator parity partial until physical iOS and Android push approve/deny loops are captured.

Record signed macOS package, notarization, and distribution handles before claiming desktop parity.

Never record TOTP seeds, generated codes, raw push tokens, encrypted payloads, or private vault values as proof.

Run mobile proof drill

Installable web app

available

manifest.webmanifest

standalone display

maskable icons

public shell service worker

Private data caching

blocked

service worker bypasses /api, dashboard, vault, Shared2FA, send, receive, settings, audit, auth routes

Authenticator parity

partial

web approval queue

mobile approval API contract

native approval notification contract

shared native approval client with local-unlock gate

Expo app target calls platform local authentication before review

shared native confirmation view model and Expo UI explain approve/deny consequences with a pre-unlock metadata checklist

shared native approval list/detail app-shell states

shared native searchable authenticator account list view model

Expo app target includes searchable authenticator account list UI

shared native otpauth setup-link import preview excludes credential material

Expo app target includes setup-link import preview UI

shared native account detail management view model

Expo app target includes account metadata, review, and rotation detail panel

shared native device migration readiness view model excludes push tokens and secrets

shared native approval loop proof covers iOS, Android, macOS, local-unlock-gated approve/deny, and notification open intent without returning codes or seeds

Expo app target includes device migration checklist UI

Expo app target shows runtime readiness without exposing token values

CLI approval commands

MCP approval tools

Microsoft Authenticator parity gates are tracked explicitly below

native push sender code shipped; production delivery not verified

Native approval contract

available

/api/mobile/approval-contract

metadata-only notification payload

machine-readable example notification payload and open intent

deep-link and web fallback contract

Native device registration

available

/api/mobile/devices

hashed push-token storage

device revoke endpoint

/mobile-devices management page

Native push approval

partial

push token registration API shipped

encrypted deliverable push-token storage shipped

metadata-only mobile approval notification outbox shipped

cron dispatch worker shipped

APNs/FCM provider sender code shipped

lock-screen notification delivery not production-verified

Biometric approval

partial

native client requires local-unlock callback before review

shared approval detail actions require local unlock

Expo target includes iOS and Android local authentication prompt

Expo target distinguishes demo mode from live API configuration

macOS companion target uses local device authentication prompt

real-device biometric approve/deny not production-verified

macOS packaged local approval not production-verified

Native clients

scaffolded

packages/secretseal-native approval client scaffold

shared iOS, Android, and macOS approval app-shell view models

apps/secretseal-mobile Expo app target scaffold

iOS and Android app identifiers declared

apps/secretseal-macos SwiftPM companion target builds and tests

macOS signed package not shipped

Same security model

Mobile clients must consume the same audited APIs.

No separate authorization rules, no seed material in notifications, and no agent plaintext access by default.

Open Shared 2FA