Thread

I think it’s fair to say that we broke new ground with our iOS remote signer. People have been trying to build something like this for a long time (even predating Nostr) and afaik all those attempts have been shut down by Apple. Some of our well informed users are concerned that our implementation breaks Apple’s rules and that Primal might get banned from the App Store. I’ll share our experience here so that other builders can benefit from it. First and foremost: we didn’t try to sneak this feature in. We provided a detailed explanation to the app store review team outlining exactly what we are doing and how. The technical tldr is: the only way to keep your iOS app running in the background is to play sound or dox user location. There is a history of developers trying to hack their way in by playing silent audio tracks or attempting to trick the reviewers (and confuse the users) in other ways. The key to our success was that we actually built a polished ambient sound feature for our signer. Some users might actually want ambient sound for their remote sessions, so we took great care to pick the appropriate sounds and build polished UI that enables users to control those sounds via the dynamic island or the live activity UI on the lock screen. We also designed an informative sound opt in screen at the beginning of the session. This is important: the user is fully informed and totally in control every step of the way. I am not sure, but it might be helpful that Primal was already a multimedia app so this feature doesn’t feel out of place. In any case, that’s how we did it; hope it helps other builders. 🫑 View quoted note β†’

Replies (14)

Thank you for all the efforts. This is really huge what you have achieved. Not only have you created the first usable signer for iOS, but you also managed to be the only signer for iOS and Android that is directly available in the normal app stores. This gives us for the first time ever a way to onboard new users smoothly into the ecosystem. Really huge for the Nostr ecosystem πŸ’œ
Yes, you can easily trigger the signer by using the standard nostrconnect:// uri scheme. That's what a "Login with Nostr" button should do. We even added support for a convenient "callback" parameter, so Primal will redirect back to your app immediately after establishing the remote connection. If it's a browser app, simply use callback=https://[your_app_login_progress_page] to get redirected back to your app. @Derek Ross implemented this flow for some of his web apps; it works great. Derek, maybe you could share a quick video of this in action?
Do you have any documentation as to how your Nostr remote signer works? I would like to know the mechanics of how it works. How/Why should i trust Primal, or others in the growing field of signers, to not know my nsec? How do i NOT paste my nsec around the Nostr clients and other parts of this new, fascinating and hopeful world? This is an honest question and i am greatful that there are other options like your new addition. I recently had challenges accessing internet in my normal route and wondered about the fragility of relying on the Alby extension which is only (mostly) available in certain browsers. Also, a related question is, how can i be sure that my first revelation of my nsec--which happened through Primal--has not compromised the sovereignty of my Nostr life? Many thanks for all that you have done for the Nostr world, which will make this world more solid, and also thank you for having introduced this new and other way of signing Nostr events.
Yes, our signer is built on the standard NIP-46 spec. We follow the spec precisely, there is nothing proprietary in our implementation. You don't need to trust Primal with your nsec; our entire stack is open, so you can see precisely how we handling it. The idea behind building a signer is precisely to minimize the need for our users to paste their nsec into any new nostr app they wish to try.