React Native integration -- what is the proper way of storing wallet account keypair?

Question

I'm very new to Solana development and want to integrate various web3 elements into my React Native app.

Currently, the app generates a keypair for a wallet account using the @solana/web3.js Keypair.generate() function and allows me to select the account. However, in order to persist the account as being selected after app minimize/restore and app close/launch events, the account needs to be stored in the files of the mobile device and reloaded from the mobile device files.

I found that React Native offers an "unofficial" library to encrypt and store data but am skeptical about storing a private key in any form on the device.

Is there a proper way of achieving persistence of the selected wallet account? Do I only need to store the public key? What measures are necessary to ensure a secure wallet integration?

P.S. Some apps require a PIN input to access the connected wallet (see Stepn)

Answer 1

Most applications will leave the key management aspect to a third-party wallet, which handles the storage of the private key, uses it to sign transactions, and offers various utility operations like checking your token balances.

Consider using something like the Solana Wallet Adapter (which has React support) instead of storing the private keys yourself. Rolling your own "wallet" within the application is possible, but security is hard and the benefits are dubious. Also, your users will likely prefer to use a well-known wallet such as Phantom, vs trusting your application to keep their private key secure.

Answer 2

In most cases all you need to achieve persistence is to store the public key of the account that needs to be remembered. Public keys can be exposed without harm(they're public for a reason) and can be saved in a variety of ways: json files, databases, decentralized storage like 'ipfs' or arweave, etc with different tradeoffs.

If you don't want to go through that hassle then can check out the concept of Program Derived Addresses on Solana here. It's a way to ensure that the same address is generated each time it's needed without having to be saved somewhere.