Cambium
NIP-55 signer that holds no keys: signing is proxied to a NIP-46 hardware bunker
New in version 0.9.0
Test and reconnect each signer, with secure relay updates where supported. Approve native requests once, for an hour or day, or indefinitely, with operation and signing-kind limits. Read request summaries and temporary details. Rename identities and edit existing grants. Filter activity and review a redacted report before sharing. Native signing batches return ordered results. Existing approvals retain their meaning; Heartwood remains the signing authority.
Cambium is an Android NIP-55 signer that holds no user keys. Cryptographic results come from a paired Heartwood hardware signer over NIP-46 (Nostr relays), with only safe, exact repeats answered from bounded per-identity caches.
Amethyst, Primal and most other Amber-compatible Android Nostr clients cannot log in to a remote NIP-46 bunker directly, but they all support signing in via any installed NIP-55 external signer. Cambium fills that gap: it registers as a signer, but it is not one. It is a thin proxy that sends uncached NIP-55 work to your hardware signer and hands the result back.
Security model:
- No user secrets ever touch the phone. Cambium stores only the bunker pairing (the paired signer's public key, its relay list, and the per-pairing connection secret) and Cambium's own ephemeral NIP-46 client keypair. Compromising the phone exposes the ability to request signatures — which the hardware signer's policy engine and physical confirmation button still gate — never the identity key itself.
- All pairing state lives in Android Keystore-backed encrypted storage.
- Per-app approval is tracked locally, in addition to whatever the hardware signer's own policy enforces. The signer remains the authority on what actually gets signed.
- All NIP-46 payloads are NIP-44-encrypted.
- Phone unlock is the one exception, and it is opt-in: a Heartwood set up to be unlocked from this phone gives it an unlock secret for that board. It signs nothing, is useless without the board's own flash, and is released only by your screen lock, once per unlock.
Features:
- Pair by QR scan or pasted bunker:// URI; multiple identities, each fully isolated.
- NIP-55 intent handling: get_public_key, sign_event, nip04/nip44 encrypt and decrypt, decrypt_zap_event (private zaps, recipient path), current_user identity selection.
- Website NIP-55 support through nostrsigner: links, with explicit one-shot approval and a validated HTTPS callback or clipboard result. Browser approval is never remembered.
- A silent content-provider path answers already-approved apps without any visible popup.
- Per-identity bounded priority queues reserve room for user work. Exact relay-authentication duplicates coalesce and cache briefly; distinct AUTH bursts are admitted one at a time, never retried internally, and paused for 60 seconds after a transport failure.
- Native approvals can be once, for an hour or day, or indefinite, with operation and signing-kind limits. Review, edit or forget choices in the connected-apps list; denial remains permanent.
- Clear request summaries and bounded, temporary request details, with private and encrypted content hidden.
- Rename paired identities, check connection health and last contact, and explicitly test or reconnect. Supported signers can securely update their NIP-46 transport relays.
- Native NIP-55 signing batches return ordered results and per-request rejections.
- Optional keep-warm foreground service so silent signing skips the reconnect penalty.
- Phone unlock: a Heartwood that restarts locked after a power cut asks this phone to unlock it. The notification names the board, why it restarted and on which network, and warns that anyone holding the board can make it ask. One tap and your screen lock unlock it. Nothing on the wire names the phone.
- Says when a paired signer has gone quiet (a power cut or network problem at the board).
- A metadata-only activity log with safe failure categories, timings and app/identity/outcome filters. Review a redacted diagnostic report before explicitly sharing it; no event content, credentials, relay addresses or identifying labels are exported.
- Optional biometric or device-credential app lock on the management screen and approval decisions.
No Google Play services, no Firebase, no analytics. Runs on any 64-bit Android 8.1+ device, including GrapheneOS.
Amethyst, Primal and most other Amber-compatible Android Nostr clients cannot log in to a remote NIP-46 bunker directly, but they all support signing in via any installed NIP-55 external signer. Cambium fills that gap: it registers as a signer, but it is not one. It is a thin proxy that sends uncached NIP-55 work to your hardware signer and hands the result back.
Security model:
- No user secrets ever touch the phone. Cambium stores only the bunker pairing (the paired signer's public key, its relay list, and the per-pairing connection secret) and Cambium's own ephemeral NIP-46 client keypair. Compromising the phone exposes the ability to request signatures — which the hardware signer's policy engine and physical confirmation button still gate — never the identity key itself.
- All pairing state lives in Android Keystore-backed encrypted storage.
- Per-app approval is tracked locally, in addition to whatever the hardware signer's own policy enforces. The signer remains the authority on what actually gets signed.
- All NIP-46 payloads are NIP-44-encrypted.
- Phone unlock is the one exception, and it is opt-in: a Heartwood set up to be unlocked from this phone gives it an unlock secret for that board. It signs nothing, is useless without the board's own flash, and is released only by your screen lock, once per unlock.
Features:
- Pair by QR scan or pasted bunker:// URI; multiple identities, each fully isolated.
- NIP-55 intent handling: get_public_key, sign_event, nip04/nip44 encrypt and decrypt, decrypt_zap_event (private zaps, recipient path), current_user identity selection.
- Website NIP-55 support through nostrsigner: links, with explicit one-shot approval and a validated HTTPS callback or clipboard result. Browser approval is never remembered.
- A silent content-provider path answers already-approved apps without any visible popup.
- Per-identity bounded priority queues reserve room for user work. Exact relay-authentication duplicates coalesce and cache briefly; distinct AUTH bursts are admitted one at a time, never retried internally, and paused for 60 seconds after a transport failure.
- Native approvals can be once, for an hour or day, or indefinite, with operation and signing-kind limits. Review, edit or forget choices in the connected-apps list; denial remains permanent.
- Clear request summaries and bounded, temporary request details, with private and encrypted content hidden.
- Rename paired identities, check connection health and last contact, and explicitly test or reconnect. Supported signers can securely update their NIP-46 transport relays.
- Native NIP-55 signing batches return ordered results and per-request rejections.
- Optional keep-warm foreground service so silent signing skips the reconnect penalty.
- Phone unlock: a Heartwood that restarts locked after a power cut asks this phone to unlock it. The notification names the board, why it restarted and on which network, and warns that anyone holding the board can make it ask. One tap and your screen lock unlock it. Nothing on the wire names the phone.
- Says when a paired signer has gone quiet (a power cut or network problem at the board).
- A metadata-only activity log with safe failure categories, timings and app/identity/outcome filters. Review a redacted diagnostic report before explicitly sharing it; no event content, credentials, relay addresses or identifying labels are exported.
- Optional biometric or device-credential app lock on the management screen and approval decisions.
No Google Play services, no Firebase, no analytics. Runs on any 64-bit Android 8.1+ device, including GrapheneOS.
- Author: Forgesworn
- License: MIT License
- Website
- Issue Tracker
- Source Code
- Changelog
- Build Metadata
- Reproducibility Status
Donate
Versions
Although APK downloads are available below to give you the choice, you should be aware that by installing that way you will not receive update notifications and it's a less secure way to download. We recommend that you install the F-Droid client and use that.
Download F-Droid-
arm64-v8ax86_64This version requires Android 8.1 or newer.
It is built and signed by the original developer, and guaranteed to correspond to this source tarball.
Download APK 18 MiB PGP Signature | Build Log
-
arm64-v8ax86_64This version requires Android 8.1 or newer.
It is built and signed by the original developer, and guaranteed to correspond to this source tarball.
Download APK 18 MiB PGP Signature | Build Log
-
arm64-v8ax86_64This version requires Android 8.1 or newer.
It is built and signed by the original developer, and guaranteed to correspond to this source tarball.
Download APK 18 MiB PGP Signature | Build Log
New in version 0.7.1
The check code stays on screen after adding a phone.
- Once the phone is added, the check code stays on the Done screen, labelled, so you can finish comparing it with the board and Sapwood.
- Release builds no longer carry git metadata, so F-Droid can reproduce this APK and publish updates again.
- Once the phone is added, the check code stays on the Done screen, labelled, so you can finish comparing it with the board and Sapwood.
- Release builds no longer carry git metadata, so F-Droid can reproduce this APK and publish updates again.
New in version 0.4.3
Keeps Amethyst relay activity from monopolising Cambium.
- Only one distinct relay-auth request per identity can enter the hardware worker.
- Failed relay auth opens a 60-second cooldown and is never retried internally.
- Posts, reactions, encryption, and cached duplicate auth remain available.
- Only one distinct relay-auth request per identity can enter the hardware worker.
- Failed relay auth opens a 60-second cooldown and is never retried internally.
- Posts, reactions, encryption, and cached duplicate auth remain available.