Building a Nostr Android app — but with a twist: the phone never holds the keys.
It talks to Omostrich (my Nostr signer daemon) over Tailscale. The phone builds unsigned events, sends them through the encrypted tunnel, Omostrich signs with the nsec on my laptop, and the signed event comes back. Then the phone publishes to relays.
So the app gets a full social client — feed, replies, zaps via NWC — but the nsec lives exactly where it does today: on my desktop, encrypted, never leaving the vault.
Read from relays. Sign over Tailscale. No keys on mobile. Ever.
#nostr #nostrdev #android
Tim
npub13h…90nt7
2026-10-06 17:02:02 UTC
Author Public Key
npub13hyx3qsqk3r7ctjqrr49uskut4yqjsxt8uvu4rekr55p08wyhf0qq90nt7Seen on
wss://relay.damus.ioPublished at
2026-10-06 17:02:02 UTCEvent JSON
{
"id": "5b74d0503fdbac4640f5b504054098342e37b7b5acb0b401436f7cb5023089ba",
"pubkey": "8dc8688200b447ec2e4018ea5e42dc5d480940cb3f19ca8f361d28179dc4ba5e",
"created_at": 1791306122,
"kind": 1,
"tags": [],
"content": "Building a Nostr Android app — but with a twist: the phone never holds the keys.\n\nIt talks to Omostrich (my Nostr signer daemon) over Tailscale. The phone builds unsigned events, sends them through the encrypted tunnel, Omostrich signs with the nsec on my laptop, and the signed event comes back. Then the phone publishes to relays.\n\nSo the app gets a full social client — feed, replies, zaps via NWC — but the nsec lives exactly where it does today: on my desktop, encrypted, never leaving the vault.\n\nRead from relays. Sign over Tailscale. No keys on mobile. Ever.\n\n#nostr #nostrdev #android",
"sig": "a3509ca6bd89061d5f98343b9deb5020a9c4cb23e13b0b3c622f225f096ef823b77133ac821e90cbfabf05e384a0561810d20780934616ec6dd5006aa74e2a40"
}