Secure Credentials & API Key Storage
Relevant source files
The following files were used as context for generating this wiki page:
Secure Credentials & API Key Storage in mausVoice is a critical subsystem designed to protect sensitive user information, specifically authentication tokens for external AI providers like Deepgram and Groq. The system follows a "local-first" security philosophy, ensuring that even though the application utilizes cloud services for transcription and cleanup, the credentials themselves are never stored in plain text on the user's machine.
The architecture leverages a hybrid approach where the TypeScript-based "Brain" (UI/Logic layer) orchestrates user interactions while the Rust-based native layer handles heavy lifting, such as cryptographic operations and direct hardware/system API access. This separation ensures that business logic remains clean while sensitive operations are executed with the performance and security guarantees of the Rust language.
Sources: llms.txt, README.md, apps/desktop/DESIGN.md
Cryptographic Architecture
The core of the security system is built upon the XChaCha20-Poly1305 algorithm. This is an authenticated encryption with associated data (AEAD) cipher that provides both confidentiality and integrity for stored keys.
Encryption Implementation
The Rust native layer implements the encryption logic. Key features include:
- Algorithm: XChaCha20-Poly1305.
- Storage Location: Keys are stored on disk but are encrypted before persistence.
- Rotation: Users can rotate or change their keys at any time through the application settings without requiring a rebuild of the software.
Sources: llms.txt, README.md, apps/desktop/src-tauri/Cargo.toml
Data Flow for Credential Management
The following diagram illustrates how an API key travels from the user interface into secure local storage.
The diagram shows the sequence of events from user input in the UI to encrypted storage on the local disk.
Sources: llms.txt, README.md, apps/desktop/README.md
Integration with AI Providers
mausVoice supports two primary external providers that require secure credential management. While the application offers a fully offline "Whisper" mode that requires no keys, many users opt for the cloud-based services for enhanced performance or specific features.
Supported Providers
| Provider | Purpose | Storage Status |
|---|---|---|
| Deepgram | Streaming transcription (nova-3 model) | Encrypted with XChaCha20-Poly1305 |
| Groq | LLM-based text cleanup and formatting | Encrypted with XChaCha20-Poly1305 |
API Permission Scoping
The application enforces security at the network level using Tauri's Content Security Policy (CSP). External domains for these providers are explicitly allowlisted in the http:default permission set, rather than being granted broad access.
{
"security": {
"csp": "connect-src 'self' https://api.groq.com https://api.deepgram.com wss://api.deepgram.com ..."
}
}
Sources: apps/desktop/src-tauri/tauri.conf.json, CLAUDE.md
Component Roles
The secure storage system is distributed across the monorepo, with specific responsibilities assigned to the TypeScript and Rust layers.
TypeScript (The Brain)
- State Management: Uses Zustand with Immer to manage the ephemeral state of API keys before they are sent to the native layer.
- User Feedback: Handles the validation of input formats and triggers UI actions (like those found in
api-key.actions.ts). - Action Flow: Coordinates between the UI events and the Tauri command bridge.
Rust (The API)
- Cryptographic Primitive: Executes the
chacha20poly1305crate operations. - System Integration: Manages the filesystem and SQLite database via
tauri-plugin-sql. - Specta Bindings: Uses Specta to ensure type-safe communication between TypeScript and Rust for key-related commands.
Sources: llms.txt, apps/desktop/README.md, apps/desktop/src-tauri/Cargo.toml
Summary of Security Features
The mausVoice secure storage system prioritizes local control and modern cryptographic standards.
| Feature | Technical Implementation |
|---|---|
| Cipher | XChaCha20-Poly1305 (AEAD) |
| Local-First | Zero cloud syncing of credentials |
| Rotatable | Dynamic updates via Settings UI |
| Type Safety | Specta-generated TS bindings for Rust commands |
| Network Security | Granular CSP allowlisting for API endpoints |
Sources: llms.txt, README.md, apps/desktop/src-tauri/tauri.conf.json
Secure Credentials & API Key Storage ensures that mausVoice remains a high-performance tool for professional use without compromising user privacy. By utilizing Rust for native cryptographic capabilities and TypeScript for orchestrating logic, the system provides a robust defense-in-depth strategy for sensitive dictation-related credentials.