On Nostr, a user’s identity is a single secret key. Every app they sign into traditionally wants that key directly, and the moment an app holds it, it holds the whole identity. The risk is sharpest in the browser, where a key pasted into a page is one bad tab away from being gone. The remote signer began as the answer to that problem: signing in to Primal on the web without the key ever reaching the browser. The key stays in a sandboxed keystore on the user’s phone, signing happens there behind a permission flow they control, and the app being signed into only ever receives a signature. The protocol already described how this should work; the job was to implement it properly, as a complete and reusable solution rather than a feature wired into one app. Done once and done well, it would do more than protect a single login: it would let a Primal user sign in to any Nostr app at all, which is the larger prize.

The work delivered a complete remote signer: the signing capability, the cross-platform library it ships as, and the audit log that keeps it accountable to the user.

The remote signer. Signing runs on NIP-46, the Nostr remote-signing standard. The secret key stays in a sandboxed keystore on the phone. An app requests a signature, the user approves or denies it, and only the signature leaves the device. Each authorized app holds one of three trust levels, minimal, scoped, or full, and every move between levels is its own confirmed moment.

One library, every app. The signer is not app code with a separate port written for each platform. Everything it does, the signing, the sessions, the permission model, and the audit log, lives in a single cross-platform library: one complete, self-contained solution. Appollo41 built that library, and the Primal Android app on top of it. The same library runs in Primal’s iOS app, imported as a finished component. The signer was built once, not once per platform.

The audit log. Everything the signer does is visible to the person who owns the key: every app they have authorized, every session per app, and every event signed in a session with its disposition, accepted, signed, rejected, or ignored, down to the exact JSON payload that was signed. The audit log was not in the original product design. We scoped it, drew the screens, brought it to product as a proposal, and shipped it.

Four decisions shaped the work more than the rest.

Standards-first. No proprietary variant was ever on the table, because interop is the whole point: someone who signs into Nostr apps through Primal should be able to sign into any Nostr app. The signer is built on three published standards. NIP-46 covers remote signing. NIP-44 is the encrypted-communication layer beneath it, shipped first as a prerequisite and non-trivial on its own. NIP-55 covers local signing on Android. We did more than implement the standards. Working with the NIP-46 author, we designed a refinement that adds a few flags to the connection handshake: an app that also needs Nostr Wallet Connect can receive its NIP-47 secret through the signer in the same exchange, rather than pairing for it separately.

The signer runs as a service. Remote signing only works if the signer is reachable: a request can arrive at any time, and something has to be listening for it. So the library carries its own long-running service, a self-contained component that accepts signing requests and returns signed responses on its own. The platform does not reimplement any of that. It stands the service up and bridges to it natively, and the signing logic stays identical from one platform to the next. On Android we host that service in the background. One host can run more than one of these services at once, and that is exactly how Nostr Wallet Connect arrived for the wallet later: a second library service under the same platform host.

One session model, local or remote. NIP-55 signs on the device; NIP-46 signs for an app running elsewhere. Rather than maintain two parallel code paths, the existing signing architecture was extended so that a session is a session whatever the source of the request. The user-facing model, the permission levels, and the audit trail are identical whether a signature was requested locally or remotely.

The permission model, mapped end to end. Three trust levels across many authorized apps produce dozens of possible transitions. If a user moves from minimal to scoped, do events already allowed at the higher scope apply? What happens moving from full back down? What even counts as a session boundary, when NIP-46 does not define one? Every transition was mapped before code was written. The unusual ones went to product for a joint decision; the low-impact ones were resolved in-house. Every screen was a state machine in the team’s heads first. The interactive demo on this page is, quite literally, that state machine, and it could not exist without the production one underneath it.

Primal 2.6 shipped the signer on Android and iOS in January 2026. The engagement leaves two results worth recording: the product in users’ hands, and the library underneath it.

The signer. It became the way a Primal user signs in across Nostr, not only to Primal but to any Nostr app, without their secret key ever leaving the phone. For a piece of security infrastructure, being recognized by Nostr developers outside Primal, not only by its own users, is the reception that counts.

The library. The signer shipped as a library, and the library is the part that compounds. It runs in production on both Primal apps. Primal’s iOS developer, who integrated it, told us it was the best library he had worked with; asked for improvement feedback after both libraries shipped, he had none. The signer library came first, and the wallet engagement that followed reused the same pattern.

None of this is the finish line. Remote signing is a strong answer to the security of Nostr keys, not a perfect one, and Appollo41 is already deep in research on what comes next: a generation of authentication that reaches beyond what a signer can do. That work is not yet public. The remote signer is one milestone, and the quest continues.