SecretStorage appears to be shared across vaults on mobile but vault-scoped on desktop

Devs: Plugins & API
1
  • Please, search the dev docs and this forum. Maybe your question has been asked!
  • If you have questions or problems specifically about the inclusion of your plugin in the community directory, post in this Discord forum.
    You won’t receive a timely answer here.

Hi, I’m developing an Obsidian plugin that stores an encryption key using app.secretStorage.

I found what appears to be different SecretStorage behavior between desktop and mobile.

On desktop, secrets with the same key name seem to remain isolated between vaults. However, on mobile, using the same secret name from multiple vaults appears to cause the value from one vault to overwrite or become visible from another vault.

For example:

// In Vault A
app.secretStorage.setSecret("test-secret", "vault-a");

// In Vault B
app.secretStorage.setSecret("test-secret", "vault-b");

// Back in Vault A
console.log(app.secretStorage.getSecret("test-secret"));

Expected behavior:

vault-a

Observed behavior on mobile:

vault-b

On desktop, the same setup appears to keep the values isolated per vault.

This caused a serious issue in my plugin because I assumed SecretStorage was vault-scoped. Each vault stores a different encryption key under the same secret name, so if mobile SecretStorage is shared across vaults, opening another vault can replace the key used by the first one.

Could you clarify whether app.secretStorage is expected to be vault-scoped?

If it is intended to be vault-scoped, the mobile behavior may be a bug. If it is intentionally app/device-scoped, it would be helpful if this were explicitly documented because it differs from the behavior.

Environment:

  • Desktop: Obsidian desktop
  • Mobile: Obsidian mobile
  • API: app.secretStorage
  • Multiple vaults opened on the same device

I can provide a minimal plugin or additional debugging information if needed.

1 Like