About
React Native mobile app with QR authentication

Tags
No tags available

Languages
TypeScript 98%, Shell 1%, JavaScript 1%

tana-mobile

React Native mobile application for the Tana blockchain with secure key management and QR authentication.

overview

tana-mobile provides a mobile-first interface for interacting with the Tana blockchain. the app securely stores Ed25519 private keys on the device and uses them to sign transactions and authenticate with web applications.

key features

secure key storage

private keys never leave the device. they are stored in the secure enclave (iOS) or Android Keystore, protected by biometric authentication. all signing operations happen locally on the device.

qr authentication

scan QR codes displayed by web applications to authenticate without entering passwords. the mobile app signs a cryptographic challenge with your private key, proving ownership without exposing the key.

web app shows QR code
        |
        v
mobile scans + signs challenge
        |
        v
web app receives signed proof
        |
        v
session established

transaction signing

review and approve transactions on your mobile device. the app displays transaction details in human-readable format before signing, preventing blind signing of malicious transactions.

real-time notifications

receive push notifications for incoming transactions, balance changes, and other account activity. notifications are delivered through the tana-notifications service.

architecture

built with React Native and Expo for cross-platform iOS and Android support. uses the Tana identity service for QR authentication flows and connects to the Tana API gateway for blockchain interactions.

authentication flow

  1. web app creates session with tana-identity
  2. user scans QR code with mobile app
  3. mobile app signs challenge with private key
  4. tana-identity verifies signature and issues session token
  5. web app receives token via server-sent events

security model

the mobile app follows a zero-trust model where the device is the only trusted environment for private key operations. web browsers and backend services never have access to private keys, eliminating entire classes of attacks.