Keystore.webCryptoP256

Creates a WebCrypto P-256 Keystore. This is the built-in default (Keystore.defaults).

By default the key is generated non-extractable: the private key never has a JS-visible encoding, and the handle holds the live CryptoKey, which persists only through structured-clone storage (Storage.idb, Storage.memory) — on string-based storage the key is session-only.

Usage

import { Keystore, Provider } from 'accounts'
 
const provider = Provider.create({
  accessKey: {
    keystores: { p256: Keystore.webCryptoP256() }, 
  },
})

Parameters

options.extractable

• Type: boolean
• Default: false

Generate the key extractable and persist it as a JWK so it survives string-based storage adapters.

Use this for environments without structured-clone storage where keys must survive restarts — React Native (with a WebCrypto implementation such as react-native-quick-crypto), Node, CLI. The private key is exported once at creation and re-imported non-extractable each session, so at-rest protection is the host app's storage adapter (pair with secureMmkv on React Native).

In browsers with IndexedDB storage, prefer the non-extractable default — it keeps the key without any JS-visible encoding, at rest or at runtime.

import { Keystore, Provider } from 'accounts'
 
const provider = Provider.create({
  accessKey: {
    keystores: {
      p256: Keystore.webCryptoP256({
        extractable: true, 
      }),
    },
  },
})