What's available to your app on Passport Prime today, what's coming, and what's intentionally not supported.
Capability matrix
| Capability | API | Status |
|---|---|---|
| Bitcoin signing (BDK) | lib/keyos/api/* | ā Stable |
| QuantumLink Bluetooth | os/quantum-link | ā Stable |
| NFC status | os/nfc | ā Stable |
| NFC read / write (NDEF) | os/nfc | š Foundation-signed only |
| Camera / QR / UR scanning | os/camera | ā Stable |
| File storage (Airlock, User, USB scopes) | os/fs | ā Stable |
| App seed and secure randomness | os/security | ā Stable |
| PIN, login, master seed | os/security | š Foundation-signed only |
| Device backups | os/backup | š Foundation-signed only |
| Keycard shard transfer | os/keycard | š Foundation-signed only |
| FIDO2 / U2F / CTAP-HID | os/fido | ā Stable |
Slint UI (@ui/... library) | sdk/ui/ui | ā Stable |
| Haptics, RGB LED, power management | os/haptics
, os/rgb-led
, os/power-manager | ā Stable |
Hosted simulator (foundation sim) | SDK | ā Stable |
Live UI preview (foundation preview) | SDK | ā Stable |
| USB HID / HWI / keyboard driver | os/usb | š§ Coming |
| Public SDK release | - | š¢ SDK 1.0.0 beta, feedback to hello@foundation.xyz |
| App catalog & store | - | š§ Roadmap |
| Developer certificate trust store | Settings ā Apps (foundation cert install) | ā Stable |
App distribution as a single .app file | foundation pack | ā Stable |
| Network / internet access | - | ā By design (Passport Prime is offline) |
Not every message in a service is available to third-party apps. Some are reserved for Foundation-signed apps, so a service can appear here as available while the specific call you want is not. The rows marked š are reserved in full. Where a service is mixed, the summary below says which parts you can use. Check the message you intend to call before designing around it.
š Open any linked
os/<service>above, choose the KeyOS snapshot matching your app, then select the crate in Rustdoc. See the API Reference landing for services not yet broken out in this matrix (app_manager,keycard,backup,update,server,settings,gui_server_api).
Per-API summaries
Bitcoin signing - lib/keyos/api/*
First-class BDK integration. Same robust hardware wallet capabilities as Passport Core: multisig, passphrases, temporary seeds, and wide software wallet support.
QuantumLink Bluetooth - os/quantum-link
Continuous secure comms with paired phones and desktops, with post-quantum encryption (CRYSTALS-Kyber) built in. The right channel for interactive protocols like Lightning, Nostr, Ark, swaps, and Coinjoins.
NFC - os/nfc
Your app can read NFC status, whether the radio is enabled and whether it is currently active. Reading and writing NDEF, and turning the radio on and off, are reserved for Foundation-signed apps, so KeyCard and Magic Backup style flows are not something a third-party app can implement today.
Camera / QR scanning - os/camera
Subscribe to camera frames to scan QR codes, UR codes, and animated QRs via the on-device Omnivision camera. Your app can also check whether the camera is enabled and whether something else is using it. Camera configuration, changing parameters and enabling the hardware, is reserved for Foundation-signed apps. The first frame subscription prompts the user to grant camera access.
File storage - os/fs
Three distinct scopes:
- Airlock - quarantined incoming files from USB or NFC, sandboxed until the user moves them.
- User - your app's private storage. Other apps cannot read it.
- USB - files exposed when Passport Prime is connected as USB mass storage.
Secure element - os/security
Cryptographic key storage and operations gated by the Microchip ATECC608C secure element. Seeds never leave the secure element unencrypted.
Two things here are available to your app:
GetAppSeed, a deterministic seed scoped to your app and derived from the device master seed. Two apps get different seeds, and yours is stable across reinstalls of the same app ID. The user grants this the first time you ask for it.GetRandom, hardware randomness from the device TRNG.getrandomandrandare wired to it, so ordinary Rust randomness is hardware-backed with nothing extra to do.
The rest of the service, PIN and login, FIDO, and anything touching the master seed directly, is reserved for Foundation-signed apps.
Your app ID is the derivation input for GetAppSeed. Change it and every key derived from the app seed changes with it, unrecoverably. Treat the app ID as key material once you start deriving from the app seed.
FIDO2 / U2F - os/fido
Full CTAP-HID stack - Passport Prime can replace a YubiKey for hardware-backed second-factor and passkey flows.
Slint UI library - sdk/ui/ui
Around 30 curated Foundation-designed components, plus theme tokens, fonts, and icons. Import from @ui/... and you get a polished, on-brand starting point that you're free to fully restyle. See Building Apps - UI
for the component list.
Device feedback and power - os/haptics, os/rgb-led, os/power-manager
Use device feedback and power-management APIs where your app is granted access. Raw buses such as GPIO, IĀ²C, SPI, and DMA are not available to third-party apps.
Why no network?
Passport Prime is intentionally offline. There is no IP stack and no Wi-Fi. The only outbound paths are USB-C, NFC, camera, and QuantumLink Bluetooth - all user-initiated, all visible. This is a security choice, not a limitation we plan to remove.
If your app needs internet data, the pattern is to have a companion phone or desktop app fetch it and pass it to Passport Prime over QuantumLink or QR.