Glossary
ECHO terms, such as space, object and epoch, are in ECHO’s glossary.
Access level
Section titled “Access level”A member’s level in a space: pull, read, edit or admin. Each level includes the ones before it. The API calls it
the member’s role. See Spaces and membership.
Auth method
Section titled “Auth method”How the guest of an invitation proves it is the intended guest: none, shared-secret or
known-public-key.
Authorization code
Section titled “Authorization code”A short code the host of an invitation shows and the guest types in. It travels by a different route from the invitation code, so intercepting one is not enough to get in.
Contact card
Section titled “Contact card”What each side of an invitation gives the other: it names an identity or device and carries the keys others need to encrypt to it and check its signatures.
Credential
Section titled “Credential”A signed statement an identity holds, such as the admission of a device, a recovery credential or access to a service.
Delegation
Section titled “Delegation”A signed statement that admits an identity, a device or a key to a group with an access level. A member can delegate no more access than it holds. See Spaces and membership.
Device
Section titled “Device”A key pair that an identity has authorized to act for it. In a browser, each profile on each site is a device, and its tabs share it. A computer can hold several devices. See Identities and devices.
The decentralized identifier that names an identity, such as did:halo:BA25QRC2FEWCSAMRP4RZL65LWJ7352CKE.
Group key
Section titled “Group key”The key a space’s current members share, which encrypts the space’s changes. It changes when membership does, and pull
members relay data encrypted with it without reading it.
Identity
Section titled “Identity”One user, as a Keyhive group named by a DID, whose members are the user’s devices. The client creates it; no server issues it.
Invitation
Section titled “Invitation”A short-lived offer that lets a device into an identity or a member into a space. See Invitations.
Invitation code
Section titled “Invitation code”The code the guest of an invitation redeems with join, usually sent as a link.
Keyhive
Section titled “Keyhive”The access control and group encryption system HALO is built on. It represents identities, devices and spaces as groups, grants access through signed delegations, and keeps each space’s encryption key for its current members. See Spaces and membership.
Member
Section titled “Member”An identity admitted to a space, with an access level.
Membership policy
Section titled “Membership policy”Whether a space admits new members by invitation (invite) or not at all (locked).
Personal space
Section titled “Personal space”A space that every identity has and only its own devices join. It carries the user’s data from device to device.
Prekey
Section titled “Prekey”A one-time key published in advance, so a guest can encrypt to the host of a delegated invitation while the host is offline.
Recovery code
Section titled “Recovery code”A phrase of words that holds a recovery credential’s key. Sometimes called a paper key.
Recovery credential
Section titled “Recovery credential”A key outside every device that can admit a new device to the identity: a recovery code, a passkey or an OAuth account. See Recovery and credentials.
Revocation
Section titled “Revocation”A signed statement that removes a member from a group. An admin can revoke anyone; another member only those it has causal seniority over.
Space key
Section titled “Space key”The value that identifies a space. Newer APIs use the space id.