MDS SDKBuild apps that connect to an MDS vault

Ask for consent, receive an isolated app lockbox, and store end-to-end encrypted data without seeing the user's MDS identity or vault keys.

One third-party client

MdsAppClient handles the redirect, PKCE, app keys, pairwise tokens, token refresh, and authenticated vault requests.

Quick start

Your app requests read, write, or read/write access. The user reviews the request in Vault Manager before your app receives a grant.

Consent model

Your app gets its own encrypted storage boundary. It cannot browse the user's home data or another app's lockbox.

Lockboxes

Your app receives an opaque per-app handle, not the user's account id, email address, global DID, or main vault id.

Architecture

Resources are encrypted and decrypted in your app. MDS stores ciphertext and wrapped keys, never your plaintext.

Encryption model

Store bytes or JSON through a typed LockboxHandle, with stable vault error codes and built-in integrity checks.

Store data