Notary: the native remote signer

Notary is a native macOS remote signer built on zig-nostr: Zig throughout, drawing its own pixels, with no Electron and no WebView anywhere. It implements the NIP-46 “bunker” protocol, so your nsec lives in a local daemon on a machine you control. Nothing gets signed quietly: you see what a client is asking for before it happens, and the key never leaves the daemon.

Notary: a native home for your key. Zig and Metal, no Electron. Your key stays in the signer.

What it does

The key never arrives: it is created and held by the signer, and this window only forwards your passphrase

One URL, any client: paste the bunker link into any Nostr app and you are connected

Nothing signs quietly: every request names itself, and waits, before anything is signed

Real windows, photographed from the running app. Every pixel inside the window is the app’s own, so nothing here shows a screen the app cannot draw. The signer pubkey and bunker:// URL come from a stub daemon; no real key appears in any of them.

How it works

A headless daemon holds the key (encrypted at rest with NIP-49) and speaks NIP-46 over relays.
A native approval GUI shows each incoming request (sign_event, nip44_encrypt, and so on) and forwards your approve/deny decision over a loopback channel. The GUI never sees the key.
Clients connect with a bunker:// URL. It works end-to-end over public relays, including those that require NIP-42 authentication.

Install (macOS, Apple Silicon)


curl -fsSL https://raw.githubusercontent.com/zig-nostr/notary/main/scripts/install-macos.sh | bash

The installer resolves the latest release, verifies its SHA-256, installs Notary.app, and launches it. Source, releases, and build instructions live at zig-nostr/notary.

Supported operations

sign_event · get_public_key · nip44_encrypt · nip44_decrypt · ping

Each is gated by a per-request approval policy with method and event-kind allowlists, so you decide exactly what a connected client may ask for.

Why it matters

The hard problem in Nostr UX is key custody: every web client that wants to post on your behalf traditionally needs your nsec. Notary is the counter-example: a fast, native key manager that signs for any client while the secret stays put. It’s the first of the zig-nostr showcases; the messenger and reader are next.