From 3dd5773fe1b72fbb01d120089f47061520285a8d Mon Sep 17 00:00:00 2001
From: Andrew Chen <hello@andrewtheguy.com>
Date: Thu, 27 Aug 2026 16:14:49 -0700
Subject: [PATCH 1/7] Replace pre-shared auth tokens with ed25519 public-key
 auth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adopt ezvpn's public-key handshake, matching ezvpn-apple and ezvpn-android: the
client authenticates with an ed25519 keypair in the shared FlexAccess format, and
the server accepts it only if the public half is on its authorized_keys file. The
ezvpn_start config's auth_token becomes auth_key.

Keys are generated and derived exclusively through the FFI
(ezvpn_generate_client_key / ezvpn_client_public_key, wrapped by
Core/Interop/AuthKey), so the key format stays owned by flexaccess-keys and is
never reimplemented in .NET.

AuthKeyStore keeps the app's shared, named key list — the same model the other
apps use: profiles reference a key by id (TunnelProfile.AuthKeyId) and, on save,
copy that key's secret into the profile's own credential, which is what the
tunnel is handed. So a key deleted from the list doesn't break profiles already
saved with it. Public halves are re-derived on load rather than stored, and a
record whose secret no longer parses is dropped from the list without being
deleted from storage (a transient native failure must not destroy a key).

Storage diverges from the siblings deliberately: they keep the whole list as one
Keychain / encrypted-preferences document, but a Credential Manager blob caps out
at 2560 bytes (about nine keys), so each key is its own ezvpn-key:<keyId>
credential. Per-record writes also mean an add, rename or delete never rewrites
the other keys. TokenStore becomes SecretStore throughout, and its reads now
distinguish "not stored" from "couldn't be read" instead of returning null for
both.

The new Auth keys dialog generates, imports, renames, copies and deletes keys;
secrets never render, and copying one is behind a confirmation. Its actions are
all inline (rename in place, confirmation flyouts) because WinUI allows only one
ContentDialog at a time. The profile editor's password box becomes a key picker
that shows the selected key's public half, warns when a profile's key has been
removed from the list, and reaches the key manager by hiding and re-showing
itself so the half-filled form survives.

Pins ezvpn.dll to v0.0.43: v0.0.36 predates the key FFI symbols. Per the repo's
no-backward-compatibility rule there is no migration — profiles saved with a
pre-shared token keep loading but fail the handshake until re-saved with a key.

Verified on the CI VM (ci/windows/remote.ps1): build, 43 Core tests, publish and
MSI all green, plus a throwaway harness against the pinned DLL confirming
generate/derive round-trips and that ezvpn_start wants exactly auth_key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CWMkFDzsTTQVQsUxpzF2wN
---
 .github/workflows/verify-ezvpn-commit.yml     |   2 +-
 CLAUDE.md                                     |  16 +-
 Directory.Build.props                         |   2 +-
 README.md                                     |  22 +-
 native/native.targets                         |   4 +-
 src/Ezvpn.App/MainWindow.xaml                 |  35 ++-
 src/Ezvpn.App/MainWindow.xaml.cs              |  53 +++-
 .../Services/CredentialAuthKeyStore.cs        |  60 ++++
 src/Ezvpn.App/Services/ProfileStore.cs        |   5 +-
 src/Ezvpn.App/Services/SecretStore.cs         | 211 ++++++++++++++
 src/Ezvpn.App/Services/TokenStore.cs          | 136 ---------
 src/Ezvpn.App/ViewModels/TunnelViewModel.cs   |  12 +
 src/Ezvpn.App/ViewModels/TunnelsManager.cs    | 112 +++++---
 src/Ezvpn.App/Views/AuthKeysDialog.xaml       | 112 ++++++++
 src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs    | 238 ++++++++++++++++
 src/Ezvpn.App/Views/TunnelEditDialog.xaml     |  22 +-
 src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs  | 100 ++++++-
 src/Ezvpn.Core/AuthKeyStore.cs                | 258 ++++++++++++++++++
 src/Ezvpn.Core/EzvpnConfig.cs                 |  20 +-
 src/Ezvpn.Core/Interop/AuthKey.cs             |  78 ++++++
 src/Ezvpn.Core/Interop/EzvpnNative.cs         |  33 ++-
 src/Ezvpn.Core/Interop/EzvpnSession.cs        |  17 +-
 src/Ezvpn.Core/TunnelProfile.cs               |  16 +-
 src/Ezvpn.Core/TunnelValidation.cs            |  23 +-
 tests/Ezvpn.Core.Tests/AuthKeyStoreTests.cs   | 215 +++++++++++++++
 tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs    |  20 +-
 .../Ezvpn.Core.Tests/TunnelValidationTests.cs |  21 +-
 27 files changed, 1576 insertions(+), 267 deletions(-)
 create mode 100644 src/Ezvpn.App/Services/CredentialAuthKeyStore.cs
 create mode 100644 src/Ezvpn.App/Services/SecretStore.cs
 delete mode 100644 src/Ezvpn.App/Services/TokenStore.cs
 create mode 100644 src/Ezvpn.App/Views/AuthKeysDialog.xaml
 create mode 100644 src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
 create mode 100644 src/Ezvpn.Core/AuthKeyStore.cs
 create mode 100644 src/Ezvpn.Core/Interop/AuthKey.cs
 create mode 100644 tests/Ezvpn.Core.Tests/AuthKeyStoreTests.cs

diff --git a/.github/workflows/verify-ezvpn-commit.yml b/.github/workflows/verify-ezvpn-commit.yml
index 52288a9..3c0bdb2 100644
--- a/.github/workflows/verify-ezvpn-commit.yml
+++ b/.github/workflows/verify-ezvpn-commit.yml
@@ -17,7 +17,7 @@ on:
       ezvpn_ref:
         description: "ezvpn git ref (commit SHA / branch / tag) to build against"
         required: true
-        default: "b41e190b130251cd20230d020bc79c6e7285b7a4"
+        default: "6f7d3475cb4032be31c7ededbb606faba60e3547"
       ezvpn_repo:
         description: "ezvpn repository (owner/name)"
         required: true
diff --git a/CLAUDE.md b/CLAUDE.md
index 9c8c533..54fa5c0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -36,8 +36,20 @@ The Rust core + C FFI live in the `../ezvpn` repo (`src/ffi_windows.rs`,
   `EzvpnConfig.Build` produces it. Keep them in sync.
 - `ClientStatus` mirrors the Rust `ClientStatus` (snake_case) from
   `../ezvpn/src/control.rs`.
-- Auth tokens live in Windows Credential Manager (`TokenStore`), never in the
-  profile JSON.
+- The client authenticates with an **ed25519 keypair**, not a pre-shared token:
+  the config's `auth_key` is the client's `ed25519-sec:…` secret, and its public
+  half goes on the server's `authorized_keys` file. Keys are generated and parsed
+  only through the FFI (`ezvpn_generate_client_key` / `ezvpn_client_public_key`,
+  wrapped by `Core/Interop/AuthKey`) — never reimplement the key format in .NET.
+- Like the Apple and Android apps, the app keeps one shared list of **named**
+  keys (`AuthKeyStore`) that profiles reference by id (`TunnelProfile.AuthKeyId`);
+  saving a profile copies that key's secret into the profile's own credential,
+  which is what `ezvpn_start` is handed. So a key deleted from the list doesn't
+  break profiles already saved with it.
+- All secrets live in Windows Credential Manager (`SecretStore`), never in the
+  profile JSON: `ezvpn:<profileId>` (the profile's auth key), `ezvpn-relay:<profileId>`
+  (the optional relay token) and `ezvpn-key:<keyId>` (one record per named key —
+  one credential each, because a credential blob caps out at 2560 bytes).
 - Installer uses **WiX v5** (v6/v7 require accepting the paid OSMF EULA). The MSI
   is unsigned by design; code signing and MSIX/Store packaging are out of scope.
 - Use classic `[DllImport]` (not `[LibraryImport]`) for the `advapi32`
diff --git a/Directory.Build.props b/Directory.Build.props
index 403e222..d726483 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -10,7 +10,7 @@
        monotonically increasing build-timestamp value so MajorUpgrade keeps working
        (see installer/Ezvpn.Installer.wixproj and .github/workflows/release.yml). -->
   <PropertyGroup>
-    <EzvpnVersion Condition="'$(EzvpnVersion)' == ''">0.0.36</EzvpnVersion>
+    <EzvpnVersion Condition="'$(EzvpnVersion)' == ''">0.0.43</EzvpnVersion>
   </PropertyGroup>
 
 </Project>
diff --git a/README.md b/README.md
index 74c73a5..c58951b 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ See `docs/Windows-App.md` in the `ezvpn` repo for the FFI contract.
 | Project | What |
 |---|---|
 | `src/Ezvpn.Core` | Pure model + config JSON builder + validation + status DTOs + the `ezvpn.dll` P/Invoke wrapper (`EzvpnSession`). No WinUI; unit-tested. |
-| `src/Ezvpn.App` | The WinUI 3 app: profile list/detail/edit, connect/disconnect, live status polling. Stores profiles under `%ProgramData%\ezvpn\profiles` and the auth token in Windows Credential Manager. |
+| `src/Ezvpn.App` | The WinUI 3 app: profile list/detail/edit, the auth-key manager, connect/disconnect, live status polling. Stores profiles under `%ProgramData%\ezvpn\profiles` and every secret in Windows Credential Manager. |
 | `tests/Ezvpn.Core.Tests` | xUnit tests for the pure logic. |
 | `installer/` | WiX v5 MSI that bundles the published app + `ezvpn.dll` + `wintun.dll`. |
 
@@ -164,8 +164,20 @@ involved.
 ## Usage
 
 1. Launch ezvpn (accept the UAC prompt).
-2. **+** to add a profile: give it a name, the server's iroh node id, the auth
-   token (required), and optional split-tunnel routes (`10.0.0.0/8`, `fd00::/8`, …).
-3. Select it and **Connect**. The status panel shows the assigned IP, gateway,
+2. Add an **auth key** (the key button in the left toolbar, or *Manage keys…* in
+   the profile editor): name it and leave the secret blank to generate a fresh
+   ed25519 keypair — or paste an `ed25519-sec:…` secret from another device to
+   reuse that identity. Copy the key's **public** half onto the server's
+   `authorized_keys` file; the secret never leaves the machine except through the
+   explicit copy action.
+3. **+** to add a profile: give it a name, the server's iroh node id, the auth key
+   to authenticate with (required), and optional split-tunnel routes
+   (`10.0.0.0/8`, `fd00::/8`, …).
+4. Select it and **Connect**. The status panel shows the assigned IP, gateway,
    routes, and the live iroh connection path once connected.
-4. **Disconnect** tears down the tunnel and routes.
+5. **Disconnect** tears down the tunnel and routes.
+
+Keys are shared across profiles: several profiles can authenticate with the same
+device identity. A profile keeps its own copy of the secret it was saved with, so
+deleting a key from the list doesn't break profiles already using it — but they
+can't be re-saved until a key is picked again.
diff --git a/native/native.targets b/native/native.targets
index e33014e..af238e7 100644
--- a/native/native.targets
+++ b/native/native.targets
@@ -29,9 +29,9 @@
          once an ezvpn release that includes the build-windows-lib asset exists.
          scripts\bump-dll.ps1 also mirrors this tag (minus "v") into EzvpnVersion in
          Directory.Build.props, which is the version the app UI + MSI report. -->
-    <EzvpnReleaseTag Condition="'$(EzvpnReleaseTag)' == ''">v0.0.36</EzvpnReleaseTag>
+    <EzvpnReleaseTag Condition="'$(EzvpnReleaseTag)' == ''">v0.0.43</EzvpnReleaseTag>
     <EzvpnDllZipUrl>https://github.com/flexaccessdev/ezvpn/releases/download/$(EzvpnReleaseTag)/ezvpn-windows.dll.zip</EzvpnDllZipUrl>
-    <EzvpnDllZipSha256>d51ecf7b0df94ad3347121c220c4735caf52fd2b7a0d5b77e7c81436b20c8d78</EzvpnDllZipSha256>
+    <EzvpnDllZipSha256>792d01e125058aebe0f73b3af54f8e6bab3d29246b51ec1abb40162bb2516f75</EzvpnDllZipSha256>
 
     <!-- Local core build used when EZVPN_LOCAL_DLL=1 (see ..\ezvpn\build-windows.ps1).
          In that mode ezvpn.dll is consumed straight from the sibling dist — it is
diff --git a/src/Ezvpn.App/MainWindow.xaml b/src/Ezvpn.App/MainWindow.xaml
index 8a4680b..ed0b960 100644
--- a/src/Ezvpn.App/MainWindow.xaml
+++ b/src/Ezvpn.App/MainWindow.xaml
@@ -57,6 +57,9 @@
                 <Button x:Name="DeleteButton" Click="DeleteButton_Click" ToolTipService.ToolTip="Delete profile">
                     <FontIcon Glyph="&#xE74D;" FontFamily="Segoe MDL2 Assets" />
                 </Button>
+                <Button x:Name="KeysButton" Click="KeysButton_Click" ToolTipService.ToolTip="Auth keys">
+                    <FontIcon Glyph="&#xE192;" FontFamily="Segoe MDL2 Assets" />
+                </Button>
             </StackPanel>
         </Grid>
 
@@ -102,31 +105,35 @@
                         <RowDefinition Height="Auto" />
                         <RowDefinition Height="Auto" />
                         <RowDefinition Height="Auto" />
+                        <RowDefinition Height="Auto" />
                     </Grid.RowDefinitions>
 
                     <TextBlock Grid.Row="0" Grid.Column="0" Text="Server node id" Style="{ThemeResource BodyStrongTextBlockStyle}" />
                     <TextBlock Grid.Row="0" Grid.Column="1" Text="{Binding ServerNodeId}" IsTextSelectionEnabled="True" TextWrapping="Wrap" />
 
-                    <TextBlock Grid.Row="1" Grid.Column="0" Text="Mode" Style="{ThemeResource BodyStrongTextBlockStyle}" />
-                    <TextBlock Grid.Row="1" Grid.Column="1" Text="{Binding Mode}" />
+                    <TextBlock Grid.Row="1" Grid.Column="0" Text="Auth key" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="1" Grid.Column="1" Text="{Binding AuthKeyName}" TextWrapping="Wrap" />
+
+                    <TextBlock Grid.Row="2" Grid.Column="0" Text="Mode" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="2" Grid.Column="1" Text="{Binding Mode}" />
 
-                    <TextBlock Grid.Row="2" Grid.Column="0" Text="Assigned IP" Style="{ThemeResource BodyStrongTextBlockStyle}" />
-                    <TextBlock Grid.Row="2" Grid.Column="1" Text="{Binding AssignedIp}" IsTextSelectionEnabled="True" />
+                    <TextBlock Grid.Row="3" Grid.Column="0" Text="Assigned IP" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="3" Grid.Column="1" Text="{Binding AssignedIp}" IsTextSelectionEnabled="True" />
 
-                    <TextBlock Grid.Row="3" Grid.Column="0" Text="Gateway" Style="{ThemeResource BodyStrongTextBlockStyle}" />
-                    <TextBlock Grid.Row="3" Grid.Column="1" Text="{Binding Gateway}" IsTextSelectionEnabled="True" />
+                    <TextBlock Grid.Row="4" Grid.Column="0" Text="Gateway" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="4" Grid.Column="1" Text="{Binding Gateway}" IsTextSelectionEnabled="True" />
 
-                    <TextBlock Grid.Row="4" Grid.Column="0" Text="Routes" Style="{ThemeResource BodyStrongTextBlockStyle}" />
-                    <TextBlock Grid.Row="4" Grid.Column="1" Text="{Binding RoutesText}" TextWrapping="Wrap" />
+                    <TextBlock Grid.Row="5" Grid.Column="0" Text="Routes" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="5" Grid.Column="1" Text="{Binding RoutesText}" TextWrapping="Wrap" />
 
-                    <TextBlock Grid.Row="5" Grid.Column="0" Text="Connection" Style="{ThemeResource BodyStrongTextBlockStyle}" />
-                    <TextBlock Grid.Row="5" Grid.Column="1" Text="{Binding ConnectionPath}" TextWrapping="Wrap" />
+                    <TextBlock Grid.Row="6" Grid.Column="0" Text="Connection" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="6" Grid.Column="1" Text="{Binding ConnectionPath}" TextWrapping="Wrap" />
 
-                    <TextBlock Grid.Row="6" Grid.Column="0" Text="Custom relays" Style="{ThemeResource BodyStrongTextBlockStyle}" />
-                    <TextBlock Grid.Row="6" Grid.Column="1" Text="{Binding CustomRelaysText}" TextWrapping="Wrap" IsTextSelectionEnabled="True" />
+                    <TextBlock Grid.Row="7" Grid.Column="0" Text="Custom relays" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="7" Grid.Column="1" Text="{Binding CustomRelaysText}" TextWrapping="Wrap" IsTextSelectionEnabled="True" />
 
-                    <TextBlock Grid.Row="7" Grid.Column="0" Text="Bypass" Style="{ThemeResource BodyStrongTextBlockStyle}" />
-                    <TextBlock Grid.Row="7" Grid.Column="1" Text="{Binding BypassText}" TextWrapping="Wrap" />
+                    <TextBlock Grid.Row="8" Grid.Column="0" Text="Bypass" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+                    <TextBlock Grid.Row="8" Grid.Column="1" Text="{Binding BypassText}" TextWrapping="Wrap" />
                 </Grid>
             </StackPanel>
         </ScrollViewer>
diff --git a/src/Ezvpn.App/MainWindow.xaml.cs b/src/Ezvpn.App/MainWindow.xaml.cs
index 3bbd3bc..43c0ea1 100644
--- a/src/Ezvpn.App/MainWindow.xaml.cs
+++ b/src/Ezvpn.App/MainWindow.xaml.cs
@@ -198,11 +198,12 @@ private async void AddButton_Click(object sender, RoutedEventArgs e)
             Title = "Add profile",
         };
         dialog.SetExistingNames(_manager.Tunnels.Select(t => t.Name));
+        dialog.SetKeys(_manager.AuthKeys.Keys);
 
-        if (await dialog.ShowAsync() == ContentDialogResult.Primary)
+        if (await ShowEditDialogAsync(dialog) == ContentDialogResult.Primary)
         {
-            var (profile, token, relayToken) = dialog.BuildResult();
-            var vm = _manager.Add(profile, token, relayToken);
+            var (profile, relayToken) = dialog.BuildResult();
+            var vm = _manager.Add(profile, relayToken);
             TunnelList.SelectedItem = vm;
         }
     }
@@ -220,15 +221,51 @@ private async void EditButton_Click(object sender, RoutedEventArgs e)
             Title = "Edit profile",
         };
         dialog.SetExistingNames(_manager.Tunnels.Where(t => t != vm).Select(t => t.Name));
-        dialog.LoadFrom(vm.Profile, _manager.LoadToken(vm), _manager.LoadRelayToken(vm));
+        dialog.SetKeys(_manager.AuthKeys.Keys);
+        dialog.LoadFrom(vm.Profile, _manager.LoadRelayToken(vm));
 
-        if (await dialog.ShowAsync() == ContentDialogResult.Primary)
+        if (await ShowEditDialogAsync(dialog) == ContentDialogResult.Primary)
         {
-            var token = dialog.ApplyTo(vm.Profile);
-            _manager.Update(vm, token, dialog.RelayToken);
+            dialog.ApplyTo(vm.Profile);
+            _manager.Update(vm, dialog.RelayToken);
         }
     }
 
+    /// <summary>
+    /// Show the profile editor, servicing its "Manage keys…" button. Only one
+    /// <see cref="ContentDialog"/> can be open at a time, so the editor hides
+    /// itself, the keys dialog runs, and then the *same* editor instance is shown
+    /// again — the half-filled form survives, with a refreshed key picker.
+    /// </summary>
+    private async Task<ContentDialogResult> ShowEditDialogAsync(TunnelEditDialog dialog)
+    {
+        while (true)
+        {
+            var result = await dialog.ShowAsync();
+            if (!dialog.ManageKeysRequested)
+            {
+                return result;
+            }
+            dialog.ClearManageKeysRequest();
+            await ShowKeysDialogAsync();
+            dialog.SetKeys(_manager.AuthKeys.Keys);
+        }
+    }
+
+    private async void KeysButton_Click(object sender, RoutedEventArgs e) =>
+        await ShowKeysDialogAsync();
+
+    /// <summary>
+    /// Run the auth-key manager, then re-read the key names the profile list and
+    /// detail panel show (a key may have been renamed or deleted).
+    /// </summary>
+    private async Task ShowKeysDialogAsync()
+    {
+        var keys = new AuthKeysDialog(_manager.AuthKeys) { XamlRoot = Content.XamlRoot };
+        await keys.ShowAsync();
+        _manager.RefreshKeyNames();
+    }
+
     private async void DeleteButton_Click(object sender, RoutedEventArgs e)
     {
         if (Selected is not { } vm)
@@ -240,7 +277,7 @@ private async void DeleteButton_Click(object sender, RoutedEventArgs e)
         {
             XamlRoot = Content.XamlRoot,
             Title = "Delete profile",
-            Content = $"Delete \"{vm.Name}\"? This also removes its stored auth token.",
+            Content = $"Delete \"{vm.Name}\"? This also removes its stored copy of the auth key. The key itself stays in the key list.",
             PrimaryButtonText = "Delete",
             CloseButtonText = "Cancel",
             DefaultButton = ContentDialogButton.Close,
diff --git a/src/Ezvpn.App/Services/CredentialAuthKeyStore.cs b/src/Ezvpn.App/Services/CredentialAuthKeyStore.cs
new file mode 100644
index 0000000..197e2c9
--- /dev/null
+++ b/src/Ezvpn.App/Services/CredentialAuthKeyStore.cs
@@ -0,0 +1,60 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Ezvpn.Core;
+
+namespace Ezvpn.App.Services;
+
+/// <summary>
+/// The app's named auth keys in Windows Credential Manager: one credential per
+/// key, targeted <c>ezvpn-key:&lt;keyId&gt;</c>, whose blob is
+/// <c>{"name":…,"secret":…}</c>. The name is not sensitive but rides along with
+/// the secret so a key is one atomic record.
+///
+/// One credential per key (rather than the single list document the Apple and
+/// Android apps store) because a Credential Manager blob is capped at 2560
+/// bytes — about nine keys — and because an add, rename or delete then never
+/// rewrites the other keys.
+/// </summary>
+public sealed class CredentialAuthKeyStore : IAuthKeyRecordStore
+{
+    private sealed class Record
+    {
+        [JsonPropertyName("name")]
+        public string Name { get; set; } = "";
+
+        [JsonPropertyName("secret")]
+        public string Secret { get; set; } = "";
+    }
+
+    public IReadOnlyList<StoredAuthKey> LoadAll()
+    {
+        var result = new List<StoredAuthKey>();
+        foreach (var (id, json) in SecretStore.Enumerate(SecretStore.KeyRecordPrefix))
+        {
+            Record? record;
+            try
+            {
+                record = JsonSerializer.Deserialize<Record>(json);
+            }
+            catch (JsonException)
+            {
+                // One unreadable record is not a broken store: skip it (the key
+                // store drops undecodable entries from the list the same way)
+                // rather than refusing every key.
+                continue;
+            }
+            if (record is not null && record.Secret.Length > 0)
+            {
+                result.Add(new StoredAuthKey(id, record.Name, record.Secret));
+            }
+        }
+        return result;
+    }
+
+    public void Save(StoredAuthKey record) =>
+        SecretStore.Write(
+            SecretStore.KeyRecordPrefix + record.Id,
+            JsonSerializer.Serialize(new Record { Name = record.Name, Secret = record.Secret }));
+
+    public void Delete(string id) => SecretStore.Delete(SecretStore.KeyRecordPrefix + id);
+}
diff --git a/src/Ezvpn.App/Services/ProfileStore.cs b/src/Ezvpn.App/Services/ProfileStore.cs
index 3d18e8d..99e3df9 100644
--- a/src/Ezvpn.App/Services/ProfileStore.cs
+++ b/src/Ezvpn.App/Services/ProfileStore.cs
@@ -6,8 +6,9 @@ namespace Ezvpn.App.Services;
 /// <summary>
 /// Persists <see cref="TunnelProfile"/> records as JSON files under
 /// <c>%ProgramData%\ezvpn\profiles\</c> (the elevated app can write there; it
-/// matches the CLI's config dir). One file per profile, named by id. The auth
-/// token is NOT stored here — see <see cref="TokenStore"/>.
+/// matches the CLI's config dir). One file per profile, named by id. No secret is
+/// stored here — the profile's auth key and relay token live in Credential
+/// Manager, see <see cref="SecretStore"/>.
 /// </summary>
 public sealed class ProfileStore
 {
diff --git a/src/Ezvpn.App/Services/SecretStore.cs b/src/Ezvpn.App/Services/SecretStore.cs
new file mode 100644
index 0000000..367f5f7
--- /dev/null
+++ b/src/Ezvpn.App/Services/SecretStore.cs
@@ -0,0 +1,211 @@
+using System.Runtime.InteropServices;
+using System.Text;
+
+namespace Ezvpn.App.Services;
+
+/// <summary>
+/// The app's secrets, in Windows Credential Manager (<c>CRED_TYPE_GENERIC</c>) —
+/// the Windows analogue of the Apple app's Keychain. Nothing secret is ever
+/// written to the profile JSON.
+///
+/// Three kinds of entry live here, distinguished by target prefix:
+/// <list type="bullet">
+/// <item><c>ezvpn:&lt;profileId&gt;</c> — the profile's copy of the ed25519 auth
+/// key it connects with (what <c>ezvpn_start</c> is handed).</item>
+/// <item><c>ezvpn-relay:&lt;profileId&gt;</c> — the optional shared relay bearer
+/// token.</item>
+/// <item><c>ezvpn-key:&lt;keyId&gt;</c> — one record of the app's named auth-key
+/// list (see <see cref="CredentialAuthKeyStore"/>).</item>
+/// </list>
+/// </summary>
+public static class SecretStore
+{
+    private const uint CRED_TYPE_GENERIC = 1;
+    private const uint CRED_PERSIST_LOCAL_MACHINE = 2;
+    private const int ERROR_NOT_FOUND = 1168;
+
+    /// <summary>Target prefix of the named auth-key records.</summary>
+    internal const string KeyRecordPrefix = "ezvpn-key:";
+
+    private static string AuthKeyTargetFor(Guid id) => "ezvpn:" + id.ToString("N");
+    private static string RelayTargetFor(Guid id) => "ezvpn-relay:" + id.ToString("N");
+
+    /// <summary>Store (or overwrite) a profile's copy of its auth key.</summary>
+    public static void SaveAuthKey(Guid id, string secret) => Write(AuthKeyTargetFor(id), secret);
+
+    /// <summary>Read a profile's auth key, or null if none is stored.</summary>
+    public static string? LoadAuthKey(Guid id) => Read(AuthKeyTargetFor(id));
+
+    /// <summary>Delete a profile's stored auth key (no-op if absent).</summary>
+    public static void DeleteAuthKey(Guid id) => Delete(AuthKeyTargetFor(id));
+
+    /// <summary>Store (or overwrite) the optional relay token for a profile.</summary>
+    public static void SaveRelayToken(Guid id, string token) => Write(RelayTargetFor(id), token);
+
+    /// <summary>Read the relay token for a profile, or null if none is stored.</summary>
+    public static string? LoadRelayToken(Guid id) => Read(RelayTargetFor(id));
+
+    /// <summary>Delete the stored relay token for a profile (no-op if absent).</summary>
+    public static void DeleteRelayToken(Guid id) => Delete(RelayTargetFor(id));
+
+    /// <summary>Write a generic credential, overwriting any existing one.</summary>
+    internal static void Write(string target, string value)
+    {
+        var blob = Encoding.Unicode.GetBytes(value);
+        var blobPtr = Marshal.AllocHGlobal(blob.Length);
+        var targetPtr = Marshal.StringToCoTaskMemUni(target);
+        try
+        {
+            Marshal.Copy(blob, 0, blobPtr, blob.Length);
+            var cred = new CREDENTIAL
+            {
+                Type = CRED_TYPE_GENERIC,
+                TargetName = targetPtr,
+                CredentialBlob = blobPtr,
+                CredentialBlobSize = (uint)blob.Length,
+                Persist = CRED_PERSIST_LOCAL_MACHINE,
+            };
+            if (!CredWriteW(ref cred, 0))
+            {
+                throw new InvalidOperationException(
+                    $"CredWrite failed (error {Marshal.GetLastWin32Error()})");
+            }
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(blobPtr);
+            Marshal.FreeCoTaskMem(targetPtr);
+        }
+    }
+
+    /// <summary>
+    /// Read a generic credential. Null means "not stored"; any other failure
+    /// throws, so a store that cannot be read is never mistaken for an empty one.
+    /// </summary>
+    internal static string? Read(string target)
+    {
+        if (!CredReadW(target, CRED_TYPE_GENERIC, 0, out var credPtr))
+        {
+            var error = Marshal.GetLastWin32Error();
+            if (error == ERROR_NOT_FOUND)
+            {
+                return null;
+            }
+            throw new InvalidOperationException($"CredRead failed (error {error})");
+        }
+        try
+        {
+            return BlobOf(Marshal.PtrToStructure<CREDENTIAL>(credPtr));
+        }
+        finally
+        {
+            CredFree(credPtr);
+        }
+    }
+
+    /// <summary>Delete a generic credential (no-op if absent).</summary>
+    internal static void Delete(string target)
+    {
+        if (!CredDeleteW(target, CRED_TYPE_GENERIC, 0))
+        {
+            var error = Marshal.GetLastWin32Error();
+            if (error == ERROR_NOT_FOUND)
+            {
+                return;
+            }
+            throw new InvalidOperationException($"CredDelete failed (error {error})");
+        }
+    }
+
+    /// <summary>
+    /// Every generic credential whose target starts with <paramref name="prefix"/>,
+    /// as (target suffix, value) pairs. An empty result means there are none; a
+    /// failure to enumerate throws.
+    /// </summary>
+    internal static IReadOnlyList<(string Suffix, string Value)> Enumerate(string prefix)
+    {
+        // CredEnumerate's filter is a target-name prefix and must end in '*'.
+        if (!CredEnumerateW(prefix + "*", 0, out var count, out var arrayPtr))
+        {
+            var error = Marshal.GetLastWin32Error();
+            if (error == ERROR_NOT_FOUND)
+            {
+                return Array.Empty<(string, string)>();
+            }
+            throw new InvalidOperationException($"CredEnumerate failed (error {error})");
+        }
+        try
+        {
+            var result = new List<(string, string)>((int)count);
+            for (var i = 0; i < count; i++)
+            {
+                var credPtr = Marshal.ReadIntPtr(arrayPtr, i * IntPtr.Size);
+                var cred = Marshal.PtrToStructure<CREDENTIAL>(credPtr);
+                var target = Marshal.PtrToStringUni(cred.TargetName);
+                // The filter is matched case-insensitively by the API, and a
+                // generic credential of another type could in principle share the
+                // prefix — keep only what we recognize.
+                if (target is null ||
+                    !target.StartsWith(prefix, StringComparison.OrdinalIgnoreCase) ||
+                    cred.Type != CRED_TYPE_GENERIC)
+                {
+                    continue;
+                }
+                result.Add((target[prefix.Length..], BlobOf(cred)));
+            }
+            return result;
+        }
+        finally
+        {
+            CredFree(arrayPtr);
+        }
+    }
+
+    /// <summary>Decode a credential's UTF-16 blob (empty when it carries none).</summary>
+    private static string BlobOf(CREDENTIAL cred)
+    {
+        if (cred.CredentialBlobSize == 0 || cred.CredentialBlob == IntPtr.Zero)
+        {
+            return string.Empty;
+        }
+        return Marshal.PtrToStringUni(cred.CredentialBlob, (int)cred.CredentialBlobSize / 2) ?? "";
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct CREDENTIAL
+    {
+        public uint Flags;
+        public uint Type;
+        public IntPtr TargetName;
+        public IntPtr Comment;
+        public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+        public uint CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public uint Persist;
+        public uint AttributeCount;
+        public IntPtr Attributes;
+        public IntPtr TargetAlias;
+        public IntPtr UserName;
+    }
+
+    // Classic DllImport (runtime marshalling) — the CREDENTIAL struct is not
+    // supported by source-generated P/Invoke without disabling runtime marshalling.
+    [DllImport("advapi32.dll", EntryPoint = "CredWriteW", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CredWriteW(ref CREDENTIAL credential, uint flags);
+
+    [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CredReadW(string target, uint type, uint flags, out IntPtr credential);
+
+    [DllImport("advapi32.dll", EntryPoint = "CredEnumerateW", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CredEnumerateW(string filter, uint flags, out uint count, out IntPtr credentials);
+
+    [DllImport("advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CredDeleteW(string target, uint type, uint flags);
+
+    [DllImport("advapi32.dll", EntryPoint = "CredFree")]
+    private static extern void CredFree(IntPtr buffer);
+}
diff --git a/src/Ezvpn.App/Services/TokenStore.cs b/src/Ezvpn.App/Services/TokenStore.cs
deleted file mode 100644
index 32509fd..0000000
--- a/src/Ezvpn.App/Services/TokenStore.cs
+++ /dev/null
@@ -1,136 +0,0 @@
-using System.Runtime.InteropServices;
-using System.Text;
-
-namespace Ezvpn.App.Services;
-
-/// <summary>
-/// Stores each profile's secret tokens in Windows Credential Manager
-/// (<c>CRED_TYPE_GENERIC</c>), keyed by <c>ezvpn:&lt;profileId&gt;</c> (the
-/// required auth token) and <c>ezvpn-relay:&lt;profileId&gt;</c> (the optional
-/// shared relay token) — the Windows analogue of the Apple app's Keychain. The
-/// profile JSON never contains a token.
-/// </summary>
-public static class TokenStore
-{
-    private const uint CRED_TYPE_GENERIC = 1;
-    private const uint CRED_PERSIST_LOCAL_MACHINE = 2;
-    private const int ERROR_NOT_FOUND = 1168;
-
-    private static string TargetFor(Guid id) => "ezvpn:" + id.ToString("N");
-    private static string RelayTargetFor(Guid id) => "ezvpn-relay:" + id.ToString("N");
-
-    /// <summary>Store (or overwrite) the auth token for a profile.</summary>
-    public static void Save(Guid id, string token) => Write(TargetFor(id), token);
-
-    /// <summary>Read the auth token for a profile, or null if none is stored.</summary>
-    public static string? Load(Guid id) => Read(TargetFor(id));
-
-    /// <summary>Delete the stored auth token for a profile (no-op if absent).</summary>
-    public static void Delete(Guid id) => DeleteTarget(TargetFor(id));
-
-    /// <summary>Store (or overwrite) the optional relay token for a profile.</summary>
-    public static void SaveRelay(Guid id, string token) => Write(RelayTargetFor(id), token);
-
-    /// <summary>Read the relay token for a profile, or null if none is stored.</summary>
-    public static string? LoadRelay(Guid id) => Read(RelayTargetFor(id));
-
-    /// <summary>Delete the stored relay token for a profile (no-op if absent).</summary>
-    public static void DeleteRelay(Guid id) => DeleteTarget(RelayTargetFor(id));
-
-    private static void DeleteTarget(string target)
-    {
-        if (!CredDeleteW(target, CRED_TYPE_GENERIC, 0))
-        {
-            var error = Marshal.GetLastWin32Error();
-            if (error == ERROR_NOT_FOUND)
-            {
-                return;
-            }
-            throw new InvalidOperationException($"CredDelete failed (error {error})");
-        }
-    }
-
-    private static void Write(string target, string token)
-    {
-        var blob = Encoding.Unicode.GetBytes(token);
-        var blobPtr = Marshal.AllocHGlobal(blob.Length);
-        var targetPtr = Marshal.StringToCoTaskMemUni(target);
-        try
-        {
-            Marshal.Copy(blob, 0, blobPtr, blob.Length);
-            var cred = new CREDENTIAL
-            {
-                Type = CRED_TYPE_GENERIC,
-                TargetName = targetPtr,
-                CredentialBlob = blobPtr,
-                CredentialBlobSize = (uint)blob.Length,
-                Persist = CRED_PERSIST_LOCAL_MACHINE,
-            };
-            if (!CredWriteW(ref cred, 0))
-            {
-                throw new InvalidOperationException(
-                    $"CredWrite failed (error {Marshal.GetLastWin32Error()})");
-            }
-        }
-        finally
-        {
-            Marshal.FreeHGlobal(blobPtr);
-            Marshal.FreeCoTaskMem(targetPtr);
-        }
-    }
-
-    private static string? Read(string target)
-    {
-        if (!CredReadW(target, CRED_TYPE_GENERIC, 0, out var credPtr))
-        {
-            return null;
-        }
-        try
-        {
-            var cred = Marshal.PtrToStructure<CREDENTIAL>(credPtr);
-            if (cred.CredentialBlobSize == 0 || cred.CredentialBlob == IntPtr.Zero)
-            {
-                return string.Empty;
-            }
-            return Marshal.PtrToStringUni(cred.CredentialBlob, (int)cred.CredentialBlobSize / 2);
-        }
-        finally
-        {
-            CredFree(credPtr);
-        }
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    private struct CREDENTIAL
-    {
-        public uint Flags;
-        public uint Type;
-        public IntPtr TargetName;
-        public IntPtr Comment;
-        public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
-        public uint CredentialBlobSize;
-        public IntPtr CredentialBlob;
-        public uint Persist;
-        public uint AttributeCount;
-        public IntPtr Attributes;
-        public IntPtr TargetAlias;
-        public IntPtr UserName;
-    }
-
-    // Classic DllImport (runtime marshalling) — the CREDENTIAL struct is not
-    // supported by source-generated P/Invoke without disabling runtime marshalling.
-    [DllImport("advapi32.dll", EntryPoint = "CredWriteW", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool CredWriteW(ref CREDENTIAL credential, uint flags);
-
-    [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool CredReadW(string target, uint type, uint flags, out IntPtr credential);
-
-    [DllImport("advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool CredDeleteW(string target, uint type, uint flags);
-
-    [DllImport("advapi32.dll", EntryPoint = "CredFree")]
-    private static extern void CredFree(IntPtr buffer);
-}
diff --git a/src/Ezvpn.App/ViewModels/TunnelViewModel.cs b/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
index b353d71..ea23108 100644
--- a/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
+++ b/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
@@ -20,6 +20,7 @@ public sealed class TunnelViewModel : ObservableObject
     private ConnectionState _state = ConnectionState.Disconnected;
     private ClientStatus? _status;
     private string? _error;
+    private string _authKeyName = "None selected";
 
     public TunnelViewModel(TunnelProfile profile)
     {
@@ -34,6 +35,17 @@ public TunnelViewModel(TunnelProfile profile)
 
     public string ServerNodeId => Profile.ServerNodeId;
 
+    /// <summary>
+    /// The display name of the auth key this profile connects with, kept in sync
+    /// by <see cref="TunnelsManager"/> (the profile itself only stores the key
+    /// id, and the key may since have been renamed or removed from the list).
+    /// </summary>
+    public string AuthKeyName
+    {
+        get => _authKeyName;
+        set => SetProperty(ref _authKeyName, value);
+    }
+
     public ConnectionState State
     {
         get => _state;
diff --git a/src/Ezvpn.App/ViewModels/TunnelsManager.cs b/src/Ezvpn.App/ViewModels/TunnelsManager.cs
index 53cc6a7..6f6c92b 100644
--- a/src/Ezvpn.App/ViewModels/TunnelsManager.cs
+++ b/src/Ezvpn.App/ViewModels/TunnelsManager.cs
@@ -31,11 +31,13 @@ public TunnelsManager(DispatcherQueue dispatcher)
     {
         _dispatcher = dispatcher;
         _store = new ProfileStore();
+        AuthKeys = new AuthKeyStore(new CredentialAuthKeyStore(), AuthKey.PublicKeyFor);
 
         foreach (var profile in _store.LoadAll())
         {
             Tunnels.Add(new TunnelViewModel(profile));
         }
+        RefreshKeyNames();
 
         _timer = _dispatcher.CreateTimer();
         _timer.Interval = PollInterval;
@@ -45,20 +47,28 @@ public TunnelsManager(DispatcherQueue dispatcher)
 
     public ObservableCollection<TunnelViewModel> Tunnels { get; } = new();
 
+    /// <summary>
+    /// The app's shared, named auth keys. Profiles reference one by id; its
+    /// secret is copied into the profile's own credential on save.
+    /// </summary>
+    public AuthKeyStore AuthKeys { get; }
+
     public TunnelViewModel? Active => _active;
 
     // --- Profile CRUD ---------------------------------------------------------
 
-    /// <summary>Add a new profile with its secret token(s) and persist it.</summary>
-    public TunnelViewModel Add(TunnelProfile profile, string authToken, string? relayAuthToken)
+    /// <summary>Add a new profile with its secrets and persist it.</summary>
+    public TunnelViewModel Add(TunnelProfile profile, string? relayAuthToken)
     {
+        var authKey = RequireAuthKey(profile);
+
         // Persist both stores before touching the live model. If a credential
-        // write fails, roll the profile (and any token) back so nothing is left
+        // write fails, roll the profile (and any secret) back so nothing is left
         // half-created.
         _store.Save(profile);
         try
         {
-            TokenStore.Save(profile.Id, authToken);
+            SecretStore.SaveAuthKey(profile.Id, authKey);
         }
         catch
         {
@@ -71,32 +81,35 @@ public TunnelViewModel Add(TunnelProfile profile, string authToken, string? rela
         }
         catch
         {
-            TokenStore.Delete(profile.Id);
+            SecretStore.DeleteAuthKey(profile.Id);
             _store.Delete(profile.Id);
             throw;
         }
 
         var vm = new TunnelViewModel(profile);
+        vm.AuthKeyName = KeyNameFor(profile);
         Tunnels.Add(vm);
         return vm;
     }
 
-    /// <summary>Persist edits to an existing profile and its secret token(s).</summary>
-    public void Update(TunnelViewModel vm, string authToken, string? relayAuthToken)
+    /// <summary>Persist edits to an existing profile and its secrets.</summary>
+    public void Update(TunnelViewModel vm, string? relayAuthToken)
     {
-        // Write the credential first (nothing on disk changes if it fails), then
-        // the profile atomically. If a later step fails, restore the prior
+        var authKey = RequireAuthKey(vm.Profile);
+
+        // Write the credentials first (nothing on disk changes if they fail),
+        // then the profile atomically. If a later step fails, restore the prior
         // credentials so the stores can't diverge.
-        var previousToken = TokenStore.Load(vm.Profile.Id);
-        var previousRelay = TokenStore.LoadRelay(vm.Profile.Id);
-        TokenStore.Save(vm.Profile.Id, authToken);
+        var previousKey = SecretStore.LoadAuthKey(vm.Profile.Id);
+        var previousRelay = SecretStore.LoadRelayToken(vm.Profile.Id);
+        SecretStore.SaveAuthKey(vm.Profile.Id, authKey);
         try
         {
             SetRelayToken(vm.Profile.Id, relayAuthToken);
         }
         catch
         {
-            RestoreAuthToken(vm.Profile.Id, previousToken);
+            RestoreAuthKey(vm.Profile.Id, previousKey);
             throw;
         }
         try
@@ -105,15 +118,16 @@ public void Update(TunnelViewModel vm, string authToken, string? relayAuthToken)
         }
         catch
         {
-            RestoreAuthToken(vm.Profile.Id, previousToken);
+            RestoreAuthKey(vm.Profile.Id, previousKey);
             SetRelayToken(vm.Profile.Id, previousRelay);
             throw;
         }
 
+        vm.AuthKeyName = KeyNameFor(vm.Profile);
         vm.NotifyProfileChanged();
     }
 
-    /// <summary>Disconnect (if active), then delete the profile and its token(s).</summary>
+    /// <summary>Disconnect (if active), then delete the profile and its secrets.</summary>
     public void Delete(TunnelViewModel vm)
     {
         if (ReferenceEquals(_active, vm))
@@ -126,8 +140,8 @@ public void Delete(TunnelViewModel vm)
         _store.Delete(vm.Profile.Id);
         try
         {
-            TokenStore.Delete(vm.Profile.Id);
-            TokenStore.DeleteRelay(vm.Profile.Id);
+            SecretStore.DeleteAuthKey(vm.Profile.Id);
+            SecretStore.DeleteRelayToken(vm.Profile.Id);
         }
         catch
         {
@@ -138,11 +152,44 @@ public void Delete(TunnelViewModel vm)
         Tunnels.Remove(vm);
     }
 
-    /// <summary>The current stored auth token for a profile (for pre-filling the edit form).</summary>
-    public string? LoadToken(TunnelViewModel vm) => TokenStore.Load(vm.Profile.Id);
-
     /// <summary>The current stored relay token for a profile, or null if none.</summary>
-    public string? LoadRelayToken(TunnelViewModel vm) => TokenStore.LoadRelay(vm.Profile.Id);
+    public string? LoadRelayToken(TunnelViewModel vm) => SecretStore.LoadRelayToken(vm.Profile.Id);
+
+    /// <summary>
+    /// Re-read every profile's auth-key name from the key list — after the keys
+    /// screen has been open, where a key may have been renamed or deleted.
+    /// </summary>
+    public void RefreshKeyNames()
+    {
+        foreach (var vm in Tunnels)
+        {
+            vm.AuthKeyName = KeyNameFor(vm.Profile);
+        }
+    }
+
+    /// <summary>
+    /// The secret of the key the profile selected. Saving requires a key that is
+    /// still in the list — the editor enforces that, so reaching here without one
+    /// is a bug rather than user error.
+    /// </summary>
+    private string RequireAuthKey(TunnelProfile profile) =>
+        AuthKeys.Find(profile.AuthKeyId)?.Secret
+        ?? throw new InvalidOperationException(
+            "This profile has no auth key selected. Pick one in the profile editor.");
+
+    /// <summary>
+    /// How the UI names a profile's key: its name, or a notice when the key has
+    /// been deleted from the list (the profile still connects with its own copy
+    /// of the secret, but cannot be re-saved until a key is picked again).
+    /// </summary>
+    private string KeyNameFor(TunnelProfile profile)
+    {
+        if (string.IsNullOrEmpty(profile.AuthKeyId))
+        {
+            return "None selected";
+        }
+        return AuthKeys.Find(profile.AuthKeyId)?.Name ?? "No longer in the key list";
+    }
 
     /// <summary>Persist (or clear) the optional relay token. A null/blank token
     /// deletes any stored item, so removing it in the editor removes the secret.</summary>
@@ -150,23 +197,23 @@ private static void SetRelayToken(Guid id, string? token)
     {
         if (string.IsNullOrWhiteSpace(token))
         {
-            TokenStore.DeleteRelay(id);
+            SecretStore.DeleteRelayToken(id);
         }
         else
         {
-            TokenStore.SaveRelay(id, token);
+            SecretStore.SaveRelayToken(id, token);
         }
     }
 
-    private static void RestoreAuthToken(Guid id, string? previousToken)
+    private static void RestoreAuthKey(Guid id, string? previousKey)
     {
-        if (previousToken is not null)
+        if (previousKey is not null)
         {
-            TokenStore.Save(id, previousToken);
+            SecretStore.SaveAuthKey(id, previousKey);
         }
         else
         {
-            TokenStore.Delete(id);
+            SecretStore.DeleteAuthKey(id);
         }
     }
 
@@ -193,12 +240,15 @@ public async Task ConnectAsync(TunnelViewModel vm)
 
         vm.SetConnecting();
 
-        var token = TokenStore.Load(vm.Profile.Id);
-        var relayToken = TokenStore.LoadRelay(vm.Profile.Id);
-        var json = EzvpnConfig.Build(vm.Profile, token, relayToken);
-
         try
         {
+            // Reading the credentials and building the config can fail too (an
+            // unreadable or missing auth key); keep it inside the try so it
+            // surfaces as a tunnel error like any other connect failure.
+            var authKey = SecretStore.LoadAuthKey(vm.Profile.Id);
+            var relayToken = SecretStore.LoadRelayToken(vm.Profile.Id);
+            var json = EzvpnConfig.Build(vm.Profile, authKey, relayToken);
+
             var session = await Task.Run(() => EzvpnSession.Start(json)).ConfigureAwait(true);
             if (generation != _generation)
             {
diff --git a/src/Ezvpn.App/Views/AuthKeysDialog.xaml b/src/Ezvpn.App/Views/AuthKeysDialog.xaml
new file mode 100644
index 0000000..0e07dcb
--- /dev/null
+++ b/src/Ezvpn.App/Views/AuthKeysDialog.xaml
@@ -0,0 +1,112 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ContentDialog
+    x:Class="Ezvpn.App.Views.AuthKeysDialog"
+    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+    xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
+    xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
+    mc:Ignorable="d"
+    Title="Auth keys"
+    CloseButtonText="Done">
+
+    <ScrollViewer>
+        <StackPanel Spacing="12" MinWidth="520">
+
+            <InfoBar x:Name="ErrorBar" IsOpen="False" Severity="Error"
+                     IsClosable="True" Title="Can't do that" />
+
+            <TextBlock TextWrapping="Wrap"
+                       Style="{ThemeResource CaptionTextBlockStyle}"
+                       Foreground="{ThemeResource TextFillColorSecondaryBrush}"
+                       Text="A profile authenticates with the key it selects. Put a key's public half on the server's authorized_keys file. Deleting a key here doesn't disconnect profiles already saved with it — re-save a profile to change the key it uses." />
+
+            <TextBlock x:Name="EmptyText" TextWrapping="Wrap" Visibility="Collapsed"
+                       Foreground="{ThemeResource TextFillColorSecondaryBrush}"
+                       Text="No auth keys yet. Generate one below (or paste a secret key from another device), then put its public key on the server." />
+
+            <ListView x:Name="KeyList" SelectionMode="None" MaxHeight="280">
+                <ListView.ItemTemplate>
+                    <DataTemplate>
+                        <Grid Padding="0,6" ColumnSpacing="8">
+                            <Grid.ColumnDefinitions>
+                                <ColumnDefinition Width="*" />
+                                <ColumnDefinition Width="Auto" />
+                            </Grid.ColumnDefinitions>
+
+                            <StackPanel Grid.Column="0" Spacing="2">
+                                <!-- Renaming happens in place: the name commits on
+                                     Enter or when the box loses focus. -->
+                                <TextBox Text="{Binding Name}" Tag="{Binding Id}"
+                                         LostFocus="OnKeyNameLostFocus"
+                                         KeyDown="OnKeyNameKeyDown" />
+                                <TextBlock Text="{Binding PublicKey}"
+                                           FontFamily="Consolas"
+                                           Style="{ThemeResource CaptionTextBlockStyle}"
+                                           Foreground="{ThemeResource TextFillColorSecondaryBrush}"
+                                           TextTrimming="CharacterEllipsis"
+                                           IsTextSelectionEnabled="True" />
+                            </StackPanel>
+
+                            <StackPanel Grid.Column="1" Orientation="Horizontal"
+                                        Spacing="4" VerticalAlignment="Top">
+                                <Button Tag="{Binding Id}" Click="OnCopyPublicKey"
+                                        ToolTipService.ToolTip="Copy public key">
+                                    <FontIcon Glyph="&#xE8C8;" FontFamily="Segoe MDL2 Assets" FontSize="14" />
+                                </Button>
+                                <!-- A flyout's content does not reliably inherit the
+                                     row's DataContext, so the confirmations read
+                                     the key id off the button the flyout hangs on
+                                     (see OnConfirmFlyoutOpening) rather than
+                                     binding to it. -->
+                                <Button Tag="{Binding Id}" ToolTipService.ToolTip="Copy secret key">
+                                    <FontIcon Glyph="&#xE785;" FontFamily="Segoe MDL2 Assets" FontSize="14" />
+                                    <Button.Flyout>
+                                        <Flyout Opening="OnConfirmFlyoutOpening">
+                                            <StackPanel Spacing="8" MaxWidth="300">
+                                                <TextBlock TextWrapping="Wrap"
+                                                           Text="Anyone holding the secret key can connect as this key. Paste it into another device's key import." />
+                                                <Button Click="OnCopySecretKey" Content="Copy secret key" />
+                                            </StackPanel>
+                                        </Flyout>
+                                    </Button.Flyout>
+                                </Button>
+                                <Button Tag="{Binding Id}" ToolTipService.ToolTip="Delete key">
+                                    <FontIcon Glyph="&#xE74D;" FontFamily="Segoe MDL2 Assets" FontSize="14" />
+                                    <Button.Flyout>
+                                        <Flyout Opening="OnConfirmFlyoutOpening">
+                                            <StackPanel Spacing="8" MaxWidth="300">
+                                                <TextBlock TextWrapping="Wrap"
+                                                           Text="The secret key is removed from this device's key list. The server keeps trusting its public key until that's taken off the authorized_keys file." />
+                                                <Button Click="OnDeleteKey" Content="Delete key"
+                                                        Style="{ThemeResource AccentButtonStyle}" />
+                                            </StackPanel>
+                                        </Flyout>
+                                    </Button.Flyout>
+                                </Button>
+                            </StackPanel>
+                        </Grid>
+                    </DataTemplate>
+                </ListView.ItemTemplate>
+            </ListView>
+
+            <Border Height="1" Background="{ThemeResource DividerStrokeColorDefaultBrush}" />
+
+            <TextBlock Text="Add a key" Style="{ThemeResource BodyStrongTextBlockStyle}" />
+
+            <TextBox x:Name="NewNameBox" Header="Name" PlaceholderText="e.g. this pc" />
+
+            <PasswordBox x:Name="NewSecretBox"
+                         Header="Secret key (leave blank to generate a new one)"
+                         PlaceholderText="ed25519-sec:…" />
+
+            <TextBlock TextWrapping="Wrap"
+                       Style="{ThemeResource CaptionTextBlockStyle}"
+                       Foreground="{ThemeResource TextFillColorSecondaryBrush}"
+                       Text="Paste a secret key generated elsewhere — copied from another device, or by &quot;flexaccess-keys generate-auth-key&quot; — to reuse that identity. Names only exist in this app's key list." />
+
+            <Button x:Name="AddKeyButton" Content="Add key" Click="OnAddKey"
+                    Style="{ThemeResource AccentButtonStyle}" HorizontalAlignment="Left" />
+
+        </StackPanel>
+    </ScrollViewer>
+</ContentDialog>
diff --git a/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs b/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
new file mode 100644
index 0000000..539c8bb
--- /dev/null
+++ b/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
@@ -0,0 +1,238 @@
+using System.Collections.ObjectModel;
+using Ezvpn.Core;
+using Ezvpn.Core.Interop;
+using Microsoft.UI.Xaml;
+using Microsoft.UI.Xaml.Controls;
+using Microsoft.UI.Xaml.Controls.Primitives;
+using Microsoft.UI.Xaml.Input;
+using Microsoft.UI.Xaml.Media;
+using Windows.ApplicationModel.DataTransfer;
+using Windows.System;
+
+namespace Ezvpn.App.Views;
+
+/// <summary>
+/// The auth-key manager: the app's shared, named ed25519 keys, with generate,
+/// import (paste a secret from another device), rename, copy and delete — the
+/// Windows counterpart of the Apple/Android "Keys" screen.
+///
+/// Public keys show unmasked (they are not secrets); secrets never render —
+/// copying one goes straight to the clipboard, behind a confirmation. Every
+/// action is inline (rename in place, confirmation flyouts) because WinUI allows
+/// only one <see cref="ContentDialog"/> open at a time, so the nested prompts
+/// the other platforms use are not available here.
+/// </summary>
+public sealed partial class AuthKeysDialog : ContentDialog
+{
+    private readonly AuthKeyStore _store;
+
+    /// <summary>
+    /// Set while <see cref="Rebuild"/> tears the rows down. Removing a row that
+    /// holds focus raises <c>LostFocus</c> on its name box, which would re-enter
+    /// the rename path (and rebuild again) for a name that just committed.
+    /// </summary>
+    private bool _rebuilding;
+
+    /// <summary>
+    /// The key whose confirmation flyout is open. Captured when the flyout opens
+    /// rather than bound inside it, because flyout content is hosted outside the
+    /// row's visual tree and does not reliably inherit its DataContext.
+    /// </summary>
+    private string? _confirmKeyId;
+
+    public AuthKeysDialog(AuthKeyStore store)
+    {
+        InitializeComponent();
+        _store = store;
+        KeyList.ItemsSource = Keys;
+        Rebuild();
+
+        // A store that couldn't be read shows an empty list but refuses every
+        // write, so say why up front rather than at the first failed add.
+        if (_store.LoadError is not null)
+        {
+            ShowError(_store.LoadError);
+        }
+    }
+
+    /// <summary>The keys on screen; rebuilt wholesale after every mutation.</summary>
+    private ObservableCollection<AuthKeyStore.Key> Keys { get; } = new();
+
+    private void Rebuild()
+    {
+        _rebuilding = true;
+        try
+        {
+            Keys.Clear();
+            foreach (var key in _store.Keys)
+            {
+                Keys.Add(key);
+            }
+        }
+        finally
+        {
+            _rebuilding = false;
+        }
+
+        var empty = Keys.Count == 0;
+        EmptyText.Visibility = empty ? Visibility.Visible : Visibility.Collapsed;
+        KeyList.Visibility = empty ? Visibility.Collapsed : Visibility.Visible;
+    }
+
+    private void OnAddKey(object sender, RoutedEventArgs args)
+    {
+        // A blank secret means "generate one for me"; anything else is an import.
+        var secret = NewSecretBox.Password;
+        if (string.IsNullOrWhiteSpace(secret))
+        {
+            var generated = AuthKey.Generate();
+            if (generated is null)
+            {
+                ShowError("Key generation failed.");
+                return;
+            }
+            secret = generated.SecretKey;
+        }
+
+        var error = _store.Add(NewNameBox.Text, secret, out _);
+        if (error is not null)
+        {
+            ShowError(error);
+            return;
+        }
+
+        NewNameBox.Text = "";
+        NewSecretBox.Password = "";
+        ErrorBar.IsOpen = false;
+        Rebuild();
+    }
+
+    /// <summary>
+    /// Commit an in-place rename. On failure the box goes back to the stored
+    /// name, so what is on screen is always what is stored.
+    /// </summary>
+    private void OnKeyNameLostFocus(object sender, RoutedEventArgs args)
+    {
+        if (_rebuilding || sender is not TextBox { Tag: string id } box)
+        {
+            return;
+        }
+
+        var error = _store.Rename(id, box.Text);
+        if (error is not null)
+        {
+            ShowError(error);
+            box.Text = _store.Find(id)?.Name ?? box.Text;
+            return;
+        }
+        Rebuild();
+    }
+
+    private void OnKeyNameKeyDown(object sender, KeyRoutedEventArgs args)
+    {
+        if (args.Key != VirtualKey.Enter)
+        {
+            return;
+        }
+        args.Handled = true;
+        // Move focus off the box so the rename commits through LostFocus — one
+        // code path for both ways of finishing an edit.
+        AddKeyButton.Focus(FocusState.Programmatic);
+    }
+
+    private void OnCopyPublicKey(object sender, RoutedEventArgs args)
+    {
+        if (KeyFor(sender) is { } key)
+        {
+            CopyToClipboard(key.PublicKey);
+        }
+    }
+
+    /// <summary>Remember which row's confirmation is being shown.</summary>
+    private void OnConfirmFlyoutOpening(object? sender, object args) =>
+        _confirmKeyId = ((sender as FlyoutBase)?.Target as FrameworkElement)?.Tag as string;
+
+    private void OnCopySecretKey(object sender, RoutedEventArgs args)
+    {
+        CloseFlyout(sender);
+        if (ConfirmedKey() is { } key)
+        {
+            CopyToClipboard(key.Secret);
+        }
+    }
+
+    private void OnDeleteKey(object sender, RoutedEventArgs args)
+    {
+        CloseFlyout(sender);
+        if (ConfirmedKey() is not { } key)
+        {
+            return;
+        }
+
+        var error = _store.Delete(key.Id);
+        if (error is not null)
+        {
+            ShowError(error);
+            return;
+        }
+        Rebuild();
+    }
+
+    /// <summary>The key a row's button belongs to (its Tag carries the key id).</summary>
+    private AuthKeyStore.Key? KeyFor(object sender) =>
+        sender is FrameworkElement { Tag: string id } ? _store.Find(id) : null;
+
+    /// <summary>
+    /// The key the open confirmation belongs to. Says so rather than doing
+    /// nothing if the flyout could not be tied back to a row.
+    /// </summary>
+    private AuthKeyStore.Key? ConfirmedKey()
+    {
+        var key = _confirmKeyId is null ? null : _store.Find(_confirmKeyId);
+        if (key is null)
+        {
+            ShowError("That key is no longer in the list.");
+        }
+        return key;
+    }
+
+    /// <summary>
+    /// Dismiss the confirmation flyout the clicked button sits in. Only that
+    /// flyout's own popup is closed — the dialog itself is hosted in a popup too.
+    /// </summary>
+    private static void CloseFlyout(object sender)
+    {
+        for (DependencyObject? node = sender as DependencyObject;
+             node is not null;
+             node = VisualTreeHelper.GetParent(node))
+        {
+            if (node is FlyoutPresenter { Parent: Popup popup })
+            {
+                popup.IsOpen = false;
+                return;
+            }
+        }
+    }
+
+    private void CopyToClipboard(string value)
+    {
+        try
+        {
+            var package = new DataPackage { RequestedOperation = DataPackageOperation.Copy };
+            package.SetText(value);
+            Clipboard.SetContent(package);
+        }
+        catch (Exception ex)
+        {
+            // The clipboard can be held by another process; that is not worth
+            // taking the dialog down for.
+            ShowError($"Couldn't copy to the clipboard: {ex.Message}");
+        }
+    }
+
+    private void ShowError(string message)
+    {
+        ErrorBar.Message = message;
+        ErrorBar.IsOpen = true;
+    }
+}
diff --git a/src/Ezvpn.App/Views/TunnelEditDialog.xaml b/src/Ezvpn.App/Views/TunnelEditDialog.xaml
index a905dd6..128d4ee 100644
--- a/src/Ezvpn.App/Views/TunnelEditDialog.xaml
+++ b/src/Ezvpn.App/Views/TunnelEditDialog.xaml
@@ -22,7 +22,27 @@
             <TextBox x:Name="NodeIdBox" Header="Server node id"
                      PlaceholderText="iroh endpoint id" TextWrapping="Wrap" AcceptsReturn="False" />
 
-            <PasswordBox x:Name="TokenBox" Header="Auth token (required)" />
+            <Grid ColumnSpacing="8" VerticalAlignment="Bottom">
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="*" />
+                    <ColumnDefinition Width="Auto" />
+                </Grid.ColumnDefinitions>
+                <ComboBox x:Name="KeyBox" Grid.Column="0" Header="Auth key (required)"
+                          HorizontalAlignment="Stretch" DisplayMemberPath="Name"
+                          PlaceholderText="Choose a key…"
+                          SelectionChanged="OnKeySelectionChanged" />
+                <Button x:Name="ManageKeysButton" Grid.Column="1" Content="Manage keys…"
+                        VerticalAlignment="Bottom" Click="OnManageKeys" />
+            </Grid>
+
+            <TextBlock x:Name="PublicKeyText" TextWrapping="Wrap" FontFamily="Consolas"
+                       Visibility="Collapsed" IsTextSelectionEnabled="True"
+                       Style="{ThemeResource CaptionTextBlockStyle}"
+                       Foreground="{ThemeResource TextFillColorSecondaryBrush}" />
+
+            <InfoBar x:Name="MissingKeyBar" IsOpen="False" Severity="Warning" IsClosable="False"
+                     Title="Auth key missing"
+                     Message="The auth key this profile used is no longer in the key list. Pick a key before saving." />
 
             <TextBox x:Name="RelayBox" Header="Relay URLs (optional, comma-separated)"
                      PlaceholderText="https://relay.example.com"
diff --git a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
index f74def7..e6a322e 100644
--- a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
+++ b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
@@ -1,4 +1,5 @@
 using Ezvpn.Core;
+using Microsoft.UI.Xaml;
 using Microsoft.UI.Xaml.Controls;
 
 namespace Ezvpn.App.Views;
@@ -13,15 +14,37 @@ public TunnelEditDialog()
         InitializeComponent();
     }
 
+    /// <summary>
+    /// Set when the user asked for the key manager. WinUI allows only one
+    /// <see cref="ContentDialog"/> at a time, so this dialog hides itself and the
+    /// caller shows the keys dialog and then re-shows this one — the same
+    /// instance, so the half-filled form survives the round trip.
+    /// </summary>
+    public bool ManageKeysRequested { get; private set; }
+
     /// <summary>Names to reject as duplicates (exclude the profile being edited).</summary>
     public void SetExistingNames(IEnumerable<string> names) => _existingNames = names.ToArray();
 
-    /// <summary>Prefill the form from an existing profile + its stored token(s).</summary>
-    public void LoadFrom(TunnelProfile profile, string? token, string? relayToken)
+    /// <summary>
+    /// Fill the auth-key picker, keeping whatever key is currently selected (by
+    /// id) if it is still listed. Call again after the keys dialog has been open.
+    /// </summary>
+    public void SetKeys(IReadOnlyList<AuthKeyStore.Key> keys)
+    {
+        var selectedId = SelectedKeyId;
+        KeyBox.ItemsSource = keys;
+        KeyBox.SelectedItem = keys.FirstOrDefault(k => k.Id == selectedId);
+        UpdatePublicKeyText();
+    }
+
+    /// <summary>The id of the selected auth key, or null when none is selected.</summary>
+    public string? SelectedKeyId => (KeyBox.SelectedItem as AuthKeyStore.Key)?.Id;
+
+    /// <summary>Prefill the form from an existing profile + its stored relay token.</summary>
+    public void LoadFrom(TunnelProfile profile, string? relayToken)
     {
         NameBox.Text = profile.Name;
         NodeIdBox.Text = profile.ServerNodeId;
-        TokenBox.Password = token ?? "";
         RelayBox.Text = string.Join(", ", profile.RelayUrls);
         RelayTokenBox.Password = relayToken ?? "";
         RoutesBox.Text = string.Join(", ", profile.Routes);
@@ -29,35 +52,82 @@ public void LoadFrom(TunnelProfile profile, string? token, string? relayToken)
         AutoReconnectCheck.IsChecked = profile.AutoReconnect;
         MaxAttemptsBox.Value = profile.MaxReconnectAttempts ?? double.NaN;
         UpdateRelayTokenEnabled();
+
+        var keys = (IReadOnlyList<AuthKeyStore.Key>?)KeyBox.ItemsSource ?? Array.Empty<AuthKeyStore.Key>();
+        KeyBox.SelectedItem = keys.FirstOrDefault(k => k.Id == profile.AuthKeyId);
+        // The profile keeps its own copy of the secret, so a key deleted from the
+        // list still connects — but there is nothing to preselect and nothing to
+        // re-save with, so say so instead of showing an empty picker with no
+        // explanation.
+        MissingKeyBar.IsOpen = profile.AuthKeyId.Length > 0 && KeyBox.SelectedItem is null;
+        UpdatePublicKeyText();
     }
 
     /// <summary>The optional relay token from the form, or null when blank.</summary>
     public string? RelayToken =>
         string.IsNullOrWhiteSpace(RelayTokenBox.Password) ? null : RelayTokenBox.Password;
 
-    /// <summary>Build a brand-new profile and its token(s) from the form (for Add).</summary>
-    public (TunnelProfile Profile, string Token, string? RelayToken) BuildResult()
+    /// <summary>Build a brand-new profile and its relay token from the form (for Add).</summary>
+    public (TunnelProfile Profile, string? RelayToken) BuildResult()
     {
         var profile = new TunnelProfile();
-        var token = ApplyTo(profile);
-        return (profile, token, RelayToken);
+        ApplyTo(profile);
+        return (profile, RelayToken);
     }
 
     /// <summary>
-    /// Write the form into <paramref name="profile"/> and return the (required)
-    /// auth token text. Validation guarantees it is non-blank before Save. The
-    /// optional relay token is read separately via <see cref="RelayToken"/>.
+    /// Write the form into <paramref name="profile"/>. Only the selected key's
+    /// <em>id</em> lands on the profile; its secret is copied into the profile's
+    /// own credential by <c>TunnelsManager</c>. The optional relay token is read
+    /// separately via <see cref="RelayToken"/>.
     /// </summary>
-    public string ApplyTo(TunnelProfile profile)
+    public void ApplyTo(TunnelProfile profile)
     {
         profile.Name = NameBox.Text.Trim();
         profile.ServerNodeId = NodeIdBox.Text.Trim();
+        profile.AuthKeyId = SelectedKeyId ?? "";
         profile.RelayUrls = TunnelValidation.SplitList(RelayBox.Text);
         profile.Routes = TunnelValidation.SplitList(RoutesBox.Text);
         profile.Routes6 = TunnelValidation.SplitList(Routes6Box.Text);
         profile.AutoReconnect = AutoReconnectCheck.IsChecked ?? true;
         profile.MaxReconnectAttempts = ParseMaxAttempts(MaxAttemptsBox.Value);
-        return TokenBox.Password;
+    }
+
+    // Hide (rather than close) so the caller can re-show this instance with the
+    // form intact once the keys dialog is done. Hide() reports None, which the
+    // caller distinguishes from Cancel by ManageKeysRequested.
+    private void OnManageKeys(object sender, RoutedEventArgs args)
+    {
+        ManageKeysRequested = true;
+        Hide();
+    }
+
+    /// <summary>Cleared by the caller once it has shown the keys dialog.</summary>
+    public void ClearManageKeysRequest() => ManageKeysRequested = false;
+
+    private void OnKeySelectionChanged(object sender, SelectionChangedEventArgs args)
+    {
+        if (KeyBox.SelectedItem is not null)
+        {
+            MissingKeyBar.IsOpen = false;
+        }
+        UpdatePublicKeyText();
+    }
+
+    // Show the selected key's public half: it is what has to be on the server's
+    // authorized_keys file, and it is not a secret.
+    private void UpdatePublicKeyText()
+    {
+        if (KeyBox.SelectedItem is AuthKeyStore.Key key)
+        {
+            PublicKeyText.Text = $"Public key (put this on the server): {key.PublicKey}";
+            PublicKeyText.Visibility = Visibility.Visible;
+        }
+        else
+        {
+            PublicKeyText.Text = "";
+            PublicKeyText.Visibility = Visibility.Collapsed;
+        }
     }
 
     // The relay token is only meaningful with custom relays: disable (and clear)
@@ -122,10 +192,10 @@ private void OnPrimaryButtonClick(ContentDialog sender, ContentDialogButtonClick
             return nodeError;
         }
 
-        var tokenError = TunnelValidation.ValidateAuthToken(TokenBox.Password);
-        if (tokenError is not null)
+        var keyError = TunnelValidation.ValidateAuthKeyId(SelectedKeyId);
+        if (keyError is not null)
         {
-            return tokenError;
+            return keyError;
         }
 
         // The relay token is custom-relay-only (the core rejects it otherwise).
diff --git a/src/Ezvpn.Core/AuthKeyStore.cs b/src/Ezvpn.Core/AuthKeyStore.cs
new file mode 100644
index 0000000..cbd9a0c
--- /dev/null
+++ b/src/Ezvpn.Core/AuthKeyStore.cs
@@ -0,0 +1,258 @@
+namespace Ezvpn.Core;
+
+/// <summary>One persisted auth key. The public half is derived, never stored.</summary>
+public sealed record StoredAuthKey(string Id, string Name, string Secret);
+
+/// <summary>
+/// Persistence for the app's named auth keys, one record per key. Implemented
+/// against Windows Credential Manager (see <c>CredentialAuthKeyStore</c>); the
+/// interface exists so <see cref="AuthKeyStore"/> stays pure and testable.
+///
+/// Unlike the Apple and Android apps — which keep the whole list as a single
+/// Keychain / encrypted-preferences document — records are stored individually
+/// here, because a Credential Manager blob caps out at 2560 bytes (about nine
+/// keys). Per-record writes also mean an add, rename or delete never rewrites
+/// the other keys.
+/// </summary>
+public interface IAuthKeyRecordStore
+{
+    /// <summary>
+    /// Every stored record, in any order. Throws when the store exists but
+    /// cannot be read — "nothing stored yet" is an empty list, never a failure.
+    /// </summary>
+    IReadOnlyList<StoredAuthKey> LoadAll();
+
+    /// <summary>Add or overwrite the record with this id.</summary>
+    void Save(StoredAuthKey record);
+
+    /// <summary>Remove the record with this id (no-op if absent).</summary>
+    void Delete(string id);
+}
+
+/// <summary>
+/// The app's shared, named client auth keys — the same model the Apple and
+/// Android apps use: one list of keypairs that profiles reference by id
+/// (<see cref="TunnelProfile.AuthKeyId"/>), so several profiles can
+/// authenticate with one device identity instead of pasting the same secret
+/// into each.
+///
+/// Public halves are never persisted — each is re-derived from its secret on
+/// load. The tunnel never reads this list: saving a profile copies the selected
+/// key's secret into that profile's own credential, which is what
+/// <c>ezvpn_start</c> is handed.
+///
+/// Mutating methods return a user-facing error message, or null on success, and
+/// leave the in-memory list untouched when the write did not land — so what is
+/// on screen is always what is actually stored.
+/// </summary>
+public sealed class AuthKeyStore
+{
+    /// <summary>One named keypair. <see cref="PublicKey"/> is derived, not persisted.</summary>
+    public sealed record Key(string Id, string Name, string Secret, string PublicKey);
+
+    private readonly IAuthKeyRecordStore _storage;
+    private readonly Func<string, string?> _derivePublicKey;
+    private readonly List<Key> _keys = new();
+
+    /// <param name="storage">Where the records live.</param>
+    /// <param name="derivePublicKey">
+    /// Derives <c>ed25519-pub:…</c> from a secret, or returns null when the
+    /// secret does not parse — normally <c>AuthKey.PublicKeyFor</c>. It is also
+    /// the validator for a pasted secret, so the key format stays owned by the
+    /// Rust core.
+    /// </param>
+    public AuthKeyStore(IAuthKeyRecordStore storage, Func<string, string?> derivePublicKey)
+    {
+        _storage = storage;
+        _derivePublicKey = derivePublicKey;
+
+        IReadOnlyList<StoredAuthKey> stored;
+        try
+        {
+            stored = storage.LoadAll();
+        }
+        catch (Exception ex)
+        {
+            LoadError = $"Couldn't read the key list: {ex.Message} " +
+                "Keys can't be changed until it can be read.";
+            return;
+        }
+
+        foreach (var record in stored)
+        {
+            // A record whose secret no longer derives a public key is corrupt —
+            // drop it from the view rather than carry an entry that can never
+            // connect. It is not deleted from storage: the derivation goes
+            // through the native library, and a transient failure there must not
+            // destroy a stored key.
+            var publicKey = _derivePublicKey(record.Secret);
+            if (publicKey is not null)
+            {
+                _keys.Add(new Key(record.Id, record.Name, record.Secret, publicKey));
+            }
+        }
+
+        _keys.Sort((a, b) => string.Compare(a.Name, b.Name, StringComparison.OrdinalIgnoreCase));
+    }
+
+    /// <summary>
+    /// Why the stored keys couldn't be read, or null once they were (nothing
+    /// stored counts as read: a fresh install genuinely has no keys). While this
+    /// is set the list on screen is not what is stored, so every write is
+    /// refused — adding a key whose name or secret duplicates an unseen one, or
+    /// deleting from a list that isn't really empty, would only make it worse.
+    /// </summary>
+    public string? LoadError { get; }
+
+    /// <summary>The keys, ordered by name.</summary>
+    public IReadOnlyList<Key> Keys => _keys;
+
+    /// <summary>The key with this id, or null if it isn't (or is no longer) listed.</summary>
+    public Key? Find(string? id) =>
+        string.IsNullOrEmpty(id) ? null : _keys.FirstOrDefault(k => k.Id == id);
+
+    /// <summary>
+    /// Validate and add a key: the name follows the profile-name rules (trimmed,
+    /// required, unique ignoring case) and the secret must parse. The same
+    /// keypair twice under two names is an accidental re-add, not a use case.
+    /// </summary>
+    public string? Add(string? name, string? secret, out Key? added)
+    {
+        added = null;
+        if (LoadError is not null)
+        {
+            return LoadError;
+        }
+
+        var trimmedName = (name ?? "").Trim();
+        var nameError = TunnelValidation.ValidateName(
+            trimmedName, _keys.Select(k => k.Name), subject: "key");
+        if (nameError is not null)
+        {
+            return nameError;
+        }
+
+        var trimmedSecret = (secret ?? "").Trim();
+        var publicKey = _derivePublicKey(trimmedSecret);
+        if (publicKey is null)
+        {
+            return "Not a valid secret key (expected ed25519-sec:…).";
+        }
+
+        var duplicate = _keys.FirstOrDefault(k => k.PublicKey == publicKey);
+        if (duplicate is not null)
+        {
+            return $"Key \"{duplicate.Name}\" already holds this secret.";
+        }
+
+        var key = new Key(Guid.NewGuid().ToString("N"), trimmedName, trimmedSecret, publicKey);
+        var error = Write(new StoredAuthKey(key.Id, key.Name, key.Secret), "save");
+        if (error is not null)
+        {
+            return error;
+        }
+
+        Insert(key);
+        added = key;
+        return null;
+    }
+
+    /// <summary>Rename a key; returns a user-facing error message, or null.</summary>
+    public string? Rename(string id, string? newName)
+    {
+        if (LoadError is not null)
+        {
+            return LoadError;
+        }
+
+        var index = _keys.FindIndex(k => k.Id == id);
+        if (index < 0)
+        {
+            return "That key is no longer in the list.";
+        }
+
+        var trimmed = (newName ?? "").Trim();
+        var nameError = TunnelValidation.ValidateName(
+            trimmed, _keys.Where(k => k.Id != id).Select(k => k.Name), subject: "key");
+        if (nameError is not null)
+        {
+            return nameError;
+        }
+
+        var previous = _keys[index];
+        if (previous.Name == trimmed)
+        {
+            return null;
+        }
+
+        var renamed = previous with { Name = trimmed };
+        var error = Write(new StoredAuthKey(renamed.Id, renamed.Name, renamed.Secret), "rename");
+        if (error is not null)
+        {
+            return error;
+        }
+
+        _keys.RemoveAt(index);
+        Insert(renamed);
+        return null;
+    }
+
+    /// <summary>
+    /// Delete a key; returns a user-facing error message when the removal
+    /// couldn't be written back (the key stays listed then, since it is still
+    /// stored). Profiles already saved with this key keep working: their own copy
+    /// of the secret is what connects. Deleting here only removes the key from
+    /// the list the profile editor picks from.
+    /// </summary>
+    public string? Delete(string id)
+    {
+        if (LoadError is not null)
+        {
+            return LoadError;
+        }
+
+        var index = _keys.FindIndex(k => k.Id == id);
+        if (index < 0)
+        {
+            return null;
+        }
+
+        try
+        {
+            _storage.Delete(id);
+        }
+        catch (Exception ex)
+        {
+            return $"Couldn't delete the key: {ex.Message}";
+        }
+
+        _keys.RemoveAt(index);
+        return null;
+    }
+
+    /// <summary>
+    /// Write one record, turning any storage failure into a user-facing message.
+    /// The caller updates the in-memory list only once this returns null, so a
+    /// failed write leaves the list exactly as it was.
+    /// </summary>
+    private string? Write(StoredAuthKey record, string verb)
+    {
+        try
+        {
+            _storage.Save(record);
+            return null;
+        }
+        catch (Exception ex)
+        {
+            return $"Couldn't {verb} the key: {ex.Message}";
+        }
+    }
+
+    /// <summary>Insert keeping <see cref="Keys"/> ordered by name.</summary>
+    private void Insert(Key key)
+    {
+        var at = _keys.FindIndex(
+            k => string.Compare(k.Name, key.Name, StringComparison.OrdinalIgnoreCase) > 0);
+        _keys.Insert(at < 0 ? _keys.Count : at, key);
+    }
+}
diff --git a/src/Ezvpn.Core/EzvpnConfig.cs b/src/Ezvpn.Core/EzvpnConfig.cs
index 2b7934b..3655a00 100644
--- a/src/Ezvpn.Core/EzvpnConfig.cs
+++ b/src/Ezvpn.Core/EzvpnConfig.cs
@@ -16,20 +16,22 @@ public static class EzvpnConfig
     };
 
     /// <summary>
-    /// Serialize <paramref name="profile"/> plus its secret token(s) into the
-    /// <c>ezvpn_start</c> config JSON. The auth token is required; a null/blank
-    /// token throws <see cref="ArgumentException"/>.
+    /// Serialize <paramref name="profile"/> plus its secrets into the
+    /// <c>ezvpn_start</c> config JSON. <paramref name="authKey"/> is the client's
+    /// ed25519 secret key (<c>ed25519-sec:…</c>), whose public half must be on
+    /// the server's authorized-keys file; it is required, and a null/blank key
+    /// throws <see cref="ArgumentException"/>.
     ///
     /// <paramref name="relayAuthToken"/> is the optional shared relay bearer
     /// token. It is only valid with custom relays: a non-blank token with no
     /// <see cref="TunnelProfile.RelayUrls"/> throws (the core rejects it too),
     /// and a null/blank token is omitted from the JSON.
     /// </summary>
-    public static string Build(TunnelProfile profile, string? authToken, string? relayAuthToken = null)
+    public static string Build(TunnelProfile profile, string? authKey, string? relayAuthToken = null)
     {
-        if (string.IsNullOrWhiteSpace(authToken))
+        if (string.IsNullOrWhiteSpace(authKey))
         {
-            throw new ArgumentException("An auth token is required.", nameof(authToken));
+            throw new ArgumentException("An auth key is required.", nameof(authKey));
         }
 
         var relayToken = string.IsNullOrWhiteSpace(relayAuthToken) ? null : relayAuthToken;
@@ -42,7 +44,7 @@ public static string Build(TunnelProfile profile, string? authToken, string? rel
         var dto = new StartConfigDto
         {
             ServerNodeId = profile.ServerNodeId,
-            AuthToken = authToken,
+            AuthKey = authKey,
             RelayUrls = profile.RelayUrls,
             RelayAuthToken = relayToken,
             Routes = profile.Routes,
@@ -59,8 +61,8 @@ private sealed class StartConfigDto
         [JsonPropertyName("server_node_id")]
         public string ServerNodeId { get; set; } = "";
 
-        [JsonPropertyName("auth_token")]
-        public string? AuthToken { get; set; }
+        [JsonPropertyName("auth_key")]
+        public string? AuthKey { get; set; }
 
         [JsonPropertyName("relay_urls")]
         public List<string> RelayUrls { get; set; } = new();
diff --git a/src/Ezvpn.Core/Interop/AuthKey.cs b/src/Ezvpn.Core/Interop/AuthKey.cs
new file mode 100644
index 0000000..bcfae2d
--- /dev/null
+++ b/src/Ezvpn.Core/Interop/AuthKey.cs
@@ -0,0 +1,78 @@
+using System.Text.Json;
+
+namespace Ezvpn.Core.Interop;
+
+/// <summary>
+/// Client auth keypair primitives, via the Rust FFI. A secret key
+/// (<c>ed25519-sec:…</c>) authenticates the tunnel handshake; its public key
+/// (<c>ed25519-pub:…</c>) is not a secret — it is what the user puts on the
+/// server's <c>authorized_keys</c> file, and it is re-derived from the secret
+/// whenever needed rather than stored. The app's named key list lives in
+/// <see cref="AuthKeyStore"/>.
+///
+/// Keys are never generated or parsed in .NET: the shared FlexAccess key format
+/// is owned by the Rust side (<c>ezvpn_generate_client_key</c> /
+/// <c>ezvpn_client_public_key</c>), exactly as in <c>ezvpn-apple</c> and
+/// <c>ezvpn-android</c>.
+/// </summary>
+public static class AuthKey
+{
+    /// <summary>A generated keypair. Both halves are the encoded token forms.</summary>
+    public sealed record Keypair(string SecretKey, string PublicKey);
+
+    /// <summary>
+    /// Generate a fresh ed25519 keypair, or null if the FFI misbehaved (or the
+    /// system RNG was unavailable).
+    /// </summary>
+    public static Keypair? Generate()
+    {
+        // On a too-small buffer the FFI writes a truncated prefix of the key
+        // document — secret material included — so zero it before it goes back on
+        // the heap rather than leaving a partial secret behind.
+        var buf = new byte[1024];
+        try
+        {
+            if (EzvpnNative.GenerateClientKey(buf, (nuint)buf.Length) != 1)
+            {
+                return null;
+            }
+
+            using var doc = JsonDocument.Parse(EzvpnNative.ReadCString(buf));
+            var secret = doc.RootElement.GetProperty("secret_key").GetString();
+            var publicKey = doc.RootElement.GetProperty("public_key").GetString();
+            if (string.IsNullOrEmpty(secret) || string.IsNullOrEmpty(publicKey))
+            {
+                return null;
+            }
+            return new Keypair(secret, publicKey);
+        }
+        catch (Exception ex) when (ex is JsonException or KeyNotFoundException or InvalidOperationException)
+        {
+            return null;
+        }
+        finally
+        {
+            Array.Clear(buf);
+        }
+    }
+
+    /// <summary>
+    /// The public key of <paramref name="secret"/>, or null when it is not a
+    /// valid secret key — which also makes this the validator for pasted keys.
+    /// </summary>
+    public static string? PublicKeyFor(string? secret)
+    {
+        var trimmed = (secret ?? "").Trim();
+        if (trimmed.Length == 0)
+        {
+            return null;
+        }
+
+        // Failure writes a diagnostic here instead of the key; the caller only
+        // needs "not a valid secret", so it is not read back.
+        var buf = new byte[256];
+        return EzvpnNative.ClientPublicKey(trimmed, buf, (nuint)buf.Length) == 1
+            ? EzvpnNative.ReadCString(buf)
+            : null;
+    }
+}
diff --git a/src/Ezvpn.Core/Interop/EzvpnNative.cs b/src/Ezvpn.Core/Interop/EzvpnNative.cs
index ccf56e5..56aa42e 100644
--- a/src/Ezvpn.Core/Interop/EzvpnNative.cs
+++ b/src/Ezvpn.Core/Interop/EzvpnNative.cs
@@ -1,10 +1,12 @@
 using System.Runtime.InteropServices;
+using System.Text;
 
 namespace Ezvpn.Core.Interop;
 
 /// <summary>
 /// Raw P/Invoke declarations for <c>ezvpn.dll</c> (see <c>windows/ezvpn.h</c>).
-/// Use <see cref="EzvpnSession"/> rather than calling these directly.
+/// Use <see cref="EzvpnSession"/> or <see cref="AuthKey"/> rather than calling
+/// these directly.
 /// </summary>
 internal static partial class EzvpnNative
 {
@@ -13,6 +15,24 @@ internal static partial class EzvpnNative
     [LibraryImport(Dll, EntryPoint = "ezvpn_init_logging")]
     internal static partial void InitLogging();
 
+    /// <summary>
+    /// Generate a fresh client keypair, written to <paramref name="outBuf"/> as
+    /// <c>{"created":…,"public_key":"ed25519-pub:…","secret_key":"ed25519-sec:…"}</c>.
+    /// Returns 1 on success, 0 if generation failed or the buffer was too small —
+    /// in which case the buffer holds a truncated prefix of the document,
+    /// <em>secret material included</em>, and must be zeroed.
+    /// </summary>
+    [LibraryImport(Dll, EntryPoint = "ezvpn_generate_client_key")]
+    internal static partial int GenerateClientKey(byte[] outBuf, nuint outLen);
+
+    /// <summary>
+    /// Derive the <c>ed25519-pub:…</c> public key of a secret key. Returns 1 with
+    /// the public key in <paramref name="outBuf"/>, or 0 with an error message
+    /// (or truncated output, if the buffer was too small).
+    /// </summary>
+    [LibraryImport(Dll, EntryPoint = "ezvpn_client_public_key", StringMarshalling = StringMarshalling.Utf8)]
+    internal static partial int ClientPublicKey(string secretKey, byte[] outBuf, nuint outLen);
+
     /// <summary>
     /// Start the client. Returns an opaque handle (or <see cref="IntPtr.Zero"/>
     /// on setup failure, in which case <paramref name="outBuf"/> holds a
@@ -30,4 +50,15 @@ internal static partial class EzvpnNative
 
     [LibraryImport(Dll, EntryPoint = "ezvpn_stop")]
     internal static partial void Stop(IntPtr handle);
+
+    /// <summary>Decode a NUL-terminated UTF-8 output buffer into a string.</summary>
+    internal static string ReadCString(byte[] buf)
+    {
+        var len = Array.IndexOf(buf, (byte)0);
+        if (len < 0)
+        {
+            len = buf.Length;
+        }
+        return Encoding.UTF8.GetString(buf, 0, len);
+    }
 }
diff --git a/src/Ezvpn.Core/Interop/EzvpnSession.cs b/src/Ezvpn.Core/Interop/EzvpnSession.cs
index 3206623..d0f4bce 100644
--- a/src/Ezvpn.Core/Interop/EzvpnSession.cs
+++ b/src/Ezvpn.Core/Interop/EzvpnSession.cs
@@ -1,5 +1,3 @@
-using System.Text;
-
 namespace Ezvpn.Core.Interop;
 
 /// <summary>Thrown when <c>ezvpn_start</c> fails during setup.</summary>
@@ -76,7 +74,7 @@ public static EzvpnSession Start(string configJson)
         var ptr = EzvpnNative.Start(configJson, err, (nuint)err.Length);
         if (ptr == IntPtr.Zero)
         {
-            var msg = ReadCString(err);
+            var msg = EzvpnNative.ReadCString(err);
             throw new EzvpnException(msg.Length > 0 ? msg : "ezvpn_start failed");
         }
         return new EzvpnSession(EzvpnSafeHandle.FromPtr(ptr));
@@ -124,7 +122,7 @@ public static EzvpnSession Start(string configJson)
                     size = Math.Min(size * 2, MaxStatusBytes);
                     continue;
                 }
-                return ReadCString(buf);
+                return EzvpnNative.ReadCString(buf);
             }
         }
         catch (ObjectDisposedException)
@@ -144,15 +142,4 @@ public static EzvpnSession Start(string configJson)
     public ClientStatus? TryGetStatus() => ClientStatus.Parse(TryGetStatusJson());
 
     public void Dispose() => _handle.Dispose();
-
-    /// <summary>Decode a NUL-terminated UTF-8 buffer into a string.</summary>
-    private static string ReadCString(byte[] buf)
-    {
-        var len = Array.IndexOf(buf, (byte)0);
-        if (len < 0)
-        {
-            len = buf.Length;
-        }
-        return Encoding.UTF8.GetString(buf, 0, len);
-    }
 }
diff --git a/src/Ezvpn.Core/TunnelProfile.cs b/src/Ezvpn.Core/TunnelProfile.cs
index 0e087a7..d11cadc 100644
--- a/src/Ezvpn.Core/TunnelProfile.cs
+++ b/src/Ezvpn.Core/TunnelProfile.cs
@@ -5,9 +5,9 @@ namespace Ezvpn.Core;
 /// <summary>
 /// A saved VPN connection profile. Mirrors the Apple app's <c>TunnelProfile</c>.
 /// There is no server IP/port/hostname — the "server address" is an iroh
-/// <see cref="ServerNodeId"/> (endpoint id). The auth token is the one secret
-/// and is NOT stored here; it lives in Windows Credential Manager keyed by
-/// <see cref="Id"/> (see <c>TokenStore</c>).
+/// <see cref="ServerNodeId"/> (endpoint id). No secret is stored here: the
+/// client's ed25519 auth key and the optional relay bearer token live in Windows
+/// Credential Manager keyed by <see cref="Id"/> (see <c>SecretStore</c>).
 /// </summary>
 public sealed class TunnelProfile
 {
@@ -23,6 +23,16 @@ public sealed class TunnelProfile
     [JsonPropertyName("serverNodeId")]
     public string ServerNodeId { get; set; } = "";
 
+    /// <summary>
+    /// Which key from the app's shared auth-key list this profile authenticates
+    /// with (<see cref="AuthKeyStore.Key.Id"/>). The key's <em>secret</em> is
+    /// never here — it is copied into the profile's own credential on save (see
+    /// <c>SecretStore</c>); this is only the non-secret reference the editor
+    /// re-selects and the UI names the key by.
+    /// </summary>
+    [JsonPropertyName("authKeyId")]
+    public string AuthKeyId { get; set; } = "";
+
     /// <summary>Optional relay URL hints. When empty, iroh uses its default relay map.</summary>
     [JsonPropertyName("relayUrls")]
     public List<string> RelayUrls { get; set; } = new();
diff --git a/src/Ezvpn.Core/TunnelValidation.cs b/src/Ezvpn.Core/TunnelValidation.cs
index 5d7fc0a..33f216d 100644
--- a/src/Ezvpn.Core/TunnelValidation.cs
+++ b/src/Ezvpn.Core/TunnelValidation.cs
@@ -14,8 +14,13 @@ public static class TunnelValidation
 {
     public const int MaxNameLength = 64;
 
-    /// <summary>Validate a profile name. Returns null if valid, else an error message.</summary>
-    public static string? ValidateName(string? name, IEnumerable<string>? existingNames = null)
+    /// <summary>
+    /// Validate a profile name. Returns null if valid, else an error message.
+    /// <paramref name="subject"/> names what is being named, so the same rules
+    /// can report on an auth key ("A key with this name already exists.").
+    /// </summary>
+    public static string? ValidateName(
+        string? name, IEnumerable<string>? existingNames = null, string subject = "profile")
     {
         var trimmed = (name ?? "").Trim();
         if (trimmed.Length == 0)
@@ -29,7 +34,7 @@ public static class TunnelValidation
         if (existingNames is not null &&
             existingNames.Any(n => string.Equals(n.Trim(), trimmed, StringComparison.OrdinalIgnoreCase)))
         {
-            return "A profile with this name already exists.";
+            return $"A {subject} with this name already exists.";
         }
         return null;
     }
@@ -54,14 +59,16 @@ public static class TunnelValidation
     }
 
     /// <summary>
-    /// Validate the auth token. It is required — a null/blank token returns an
-    /// error message; otherwise null.
+    /// Validate a profile's auth-key selection. A profile authenticates with one
+    /// of the app's named keys (see <see cref="AuthKeyStore"/>), so an id is
+    /// required; the secret itself is validated by the key store, which derives
+    /// its public half through the Rust core.
     /// </summary>
-    public static string? ValidateAuthToken(string? token)
+    public static string? ValidateAuthKeyId(string? authKeyId)
     {
-        if (string.IsNullOrWhiteSpace(token))
+        if (string.IsNullOrWhiteSpace(authKeyId))
         {
-            return "Auth token is required.";
+            return "An auth key is required — pick one, or add one under Manage keys.";
         }
         return null;
     }
diff --git a/tests/Ezvpn.Core.Tests/AuthKeyStoreTests.cs b/tests/Ezvpn.Core.Tests/AuthKeyStoreTests.cs
new file mode 100644
index 0000000..0a4108d
--- /dev/null
+++ b/tests/Ezvpn.Core.Tests/AuthKeyStoreTests.cs
@@ -0,0 +1,215 @@
+using Ezvpn.Core;
+using Xunit;
+
+namespace Ezvpn.Core.Tests;
+
+public class AuthKeyStoreTests
+{
+    /// <summary>
+    /// In-memory stand-in for Credential Manager. <see cref="FailOn"/> makes one
+    /// kind of write blow up, the way a Credential Manager failure would.
+    /// </summary>
+    private sealed class FakeRecordStore : IAuthKeyRecordStore
+    {
+        public Dictionary<string, StoredAuthKey> Records { get; } = new();
+        public bool FailLoad { get; set; }
+        public string? FailOn { get; set; } // "save" or "delete"
+
+        public IReadOnlyList<StoredAuthKey> LoadAll() =>
+            FailLoad
+                ? throw new InvalidOperationException("CredEnumerate failed (error 5).")
+                : Records.Values.ToList();
+
+        public void Save(StoredAuthKey record)
+        {
+            if (FailOn == "save")
+            {
+                throw new InvalidOperationException("CredWrite failed (error 87).");
+            }
+            Records[record.Id] = record;
+        }
+
+        public void Delete(string id)
+        {
+            if (FailOn == "delete")
+            {
+                throw new InvalidOperationException("CredDelete failed (error 5).");
+            }
+            Records.Remove(id);
+        }
+    }
+
+    // Public halves are derived, never stored: the fake mirrors the Rust core by
+    // accepting only the "ed25519-sec:" form and deriving a matching public key.
+    private static string? Derive(string secret) =>
+        secret.StartsWith("ed25519-sec:", StringComparison.Ordinal)
+            ? "ed25519-pub:" + secret["ed25519-sec:".Length..]
+            : null;
+
+    private static AuthKeyStore StoreOver(FakeRecordStore storage) =>
+        new(storage, Derive);
+
+    [Fact]
+    public void Add_StoresTheRecordAndDerivesThePublicKey()
+    {
+        var storage = new FakeRecordStore();
+        var store = StoreOver(storage);
+
+        Assert.Null(store.Add("laptop", "  ed25519-sec:AAAA  ", out var added));
+        Assert.NotNull(added);
+        Assert.Equal("laptop", added!.Name);
+        // The secret is trimmed and the public half derived, not persisted.
+        Assert.Equal("ed25519-sec:AAAA", added.Secret);
+        Assert.Equal("ed25519-pub:AAAA", added.PublicKey);
+        Assert.Equal(added.Secret, Assert.Single(storage.Records).Value.Secret);
+        Assert.Same(added, store.Find(added.Id));
+    }
+
+    [Fact]
+    public void Add_RejectsBlankAndDuplicateNames()
+    {
+        var store = StoreOver(new FakeRecordStore());
+        store.Add("laptop", "ed25519-sec:AAAA", out _);
+
+        Assert.NotNull(store.Add("", "ed25519-sec:BBBB", out _));
+        Assert.Contains("A key with this name", store.Add("Laptop", "ed25519-sec:BBBB", out _));
+        Assert.Single(store.Keys);
+    }
+
+    [Fact]
+    public void Add_RejectsAnUnparsableSecret()
+    {
+        var store = StoreOver(new FakeRecordStore());
+
+        Assert.Contains("Not a valid secret key", store.Add("laptop", "hunter2", out var added));
+        Assert.Null(added);
+        Assert.Empty(store.Keys);
+    }
+
+    [Fact]
+    public void Add_RejectsTheSameKeypairTwice()
+    {
+        var store = StoreOver(new FakeRecordStore());
+        store.Add("laptop", "ed25519-sec:AAAA", out _);
+
+        Assert.Contains("already holds this secret", store.Add("desktop", "ed25519-sec:AAAA", out _));
+        Assert.Single(store.Keys);
+    }
+
+    [Fact]
+    public void Add_LeavesTheListUntouchedWhenTheWriteFails()
+    {
+        var storage = new FakeRecordStore { FailOn = "save" };
+        var store = StoreOver(storage);
+
+        Assert.Contains("CredWrite failed", store.Add("laptop", "ed25519-sec:AAAA", out var added));
+        Assert.Null(added);
+        Assert.Empty(store.Keys);
+        Assert.Empty(storage.Records);
+    }
+
+    [Fact]
+    public void Rename_ValidatesAndPersists()
+    {
+        var storage = new FakeRecordStore();
+        var store = StoreOver(storage);
+        store.Add("laptop", "ed25519-sec:AAAA", out var key);
+        store.Add("desktop", "ed25519-sec:BBBB", out _);
+
+        Assert.NotNull(store.Rename(key!.Id, "  Desktop "));       // duplicate
+        Assert.NotNull(store.Rename(key.Id, "   "));               // blank
+        Assert.Null(store.Rename(key.Id, "  work laptop "));
+
+        Assert.Equal("work laptop", store.Find(key.Id)!.Name);
+        Assert.Equal("work laptop", storage.Records[key.Id].Name);
+        // The secret rides along unchanged.
+        Assert.Equal("ed25519-sec:AAAA", storage.Records[key.Id].Secret);
+    }
+
+    [Fact]
+    public void Rename_KeepsTheStoredNameWhenTheWriteFails()
+    {
+        var storage = new FakeRecordStore();
+        var store = StoreOver(storage);
+        store.Add("laptop", "ed25519-sec:AAAA", out var key);
+
+        storage.FailOn = "save";
+        Assert.Contains("CredWrite failed", store.Rename(key!.Id, "renamed"));
+        Assert.Equal("laptop", store.Find(key.Id)!.Name);
+    }
+
+    [Fact]
+    public void Delete_RemovesTheRecord_AndKeepsItWhenTheWriteFails()
+    {
+        var storage = new FakeRecordStore();
+        var store = StoreOver(storage);
+        store.Add("laptop", "ed25519-sec:AAAA", out var key);
+
+        storage.FailOn = "delete";
+        Assert.Contains("CredDelete failed", store.Delete(key!.Id));
+        Assert.Single(store.Keys);
+
+        storage.FailOn = null;
+        Assert.Null(store.Delete(key.Id));
+        Assert.Empty(store.Keys);
+        Assert.Empty(storage.Records);
+        // Deleting what is already gone is a no-op, not an error.
+        Assert.Null(store.Delete(key.Id));
+    }
+
+    [Fact]
+    public void Keys_AreOrderedByNameAndStayOrderedThroughEdits()
+    {
+        var store = StoreOver(new FakeRecordStore());
+        store.Add("zeta", "ed25519-sec:AAAA", out _);
+        store.Add("alpha", "ed25519-sec:BBBB", out var alpha);
+        store.Add("Mid", "ed25519-sec:CCCC", out _);
+
+        Assert.Equal(new[] { "alpha", "Mid", "zeta" }, store.Keys.Select(k => k.Name));
+
+        store.Rename(alpha!.Id, "omega");
+        Assert.Equal(new[] { "Mid", "omega", "zeta" }, store.Keys.Select(k => k.Name));
+    }
+
+    [Fact]
+    public void Load_DropsRecordsWhoseSecretNoLongerParses_WithoutDeletingThem()
+    {
+        var storage = new FakeRecordStore();
+        storage.Records["a"] = new StoredAuthKey("a", "good", "ed25519-sec:AAAA");
+        storage.Records["b"] = new StoredAuthKey("b", "corrupt", "garbage");
+
+        var store = StoreOver(storage);
+
+        Assert.Equal("good", Assert.Single(store.Keys).Name);
+        // Derivation goes through the native library; a transient failure there
+        // must not destroy a stored key.
+        Assert.Equal(2, storage.Records.Count);
+    }
+
+    [Fact]
+    public void AnUnreadableStore_ReportsAndRefusesEveryWrite()
+    {
+        var storage = new FakeRecordStore { FailLoad = true };
+        var store = StoreOver(storage);
+
+        Assert.NotNull(store.LoadError);
+        Assert.Empty(store.Keys);
+        // An empty list here is a partial view of the real one, so adding,
+        // renaming or deleting against it would only make things worse.
+        Assert.Equal(store.LoadError, store.Add("laptop", "ed25519-sec:AAAA", out _));
+        Assert.Equal(store.LoadError, store.Rename("a", "laptop"));
+        Assert.Equal(store.LoadError, store.Delete("a"));
+        Assert.Empty(storage.Records);
+    }
+
+    [Fact]
+    public void AnEmptyStore_IsNotALoadFailure()
+    {
+        var store = StoreOver(new FakeRecordStore());
+
+        Assert.Null(store.LoadError);
+        Assert.Empty(store.Keys);
+        Assert.Null(store.Find(""));
+        Assert.Null(store.Find(null));
+    }
+}
diff --git a/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs b/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
index d1ee002..4378c31 100644
--- a/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
+++ b/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
@@ -19,7 +19,7 @@ public void Build_EmitsSnakeCaseKeys_AndOmitsNulls()
             AutoReconnect = true,
         };
 
-        var json = EzvpnConfig.Build(profile, "tok");
+        var json = EzvpnConfig.Build(profile, "ed25519-sec:key");
         using var doc = JsonDocument.Parse(json);
         var root = doc.RootElement;
 
@@ -32,6 +32,10 @@ public void Build_EmitsSnakeCaseKeys_AndOmitsNulls()
         Assert.Equal(profile.Instance, root.GetProperty("instance").GetString());
         // Null max attempts is omitted, not emitted as null.
         Assert.False(root.TryGetProperty("max_reconnect_attempts", out _));
+        // The auth key is the one required secret and is always emitted.
+        Assert.Equal("ed25519-sec:key", root.GetProperty("auth_key").GetString());
+        // The pre-shared token this replaced must not linger in the config.
+        Assert.False(root.TryGetProperty("auth_token", out _));
         // No relay token was supplied, so the key is omitted.
         Assert.False(root.TryGetProperty("relay_auth_token", out _));
     }
@@ -45,7 +49,7 @@ public void Build_EmitsRelayAuthToken_WithCustomRelays()
             RelayUrls = { "https://relay.example/" },
         };
 
-        var json = EzvpnConfig.Build(profile, "tok", "relay-secret");
+        var json = EzvpnConfig.Build(profile, "ed25519-sec:key", "relay-secret");
         using var doc = JsonDocument.Parse(json);
 
         Assert.Equal("relay-secret", doc.RootElement.GetProperty("relay_auth_token").GetString());
@@ -60,7 +64,7 @@ public void Build_OmitsBlankRelayAuthToken()
             RelayUrls = { "https://relay.example/" },
         };
 
-        var json = EzvpnConfig.Build(profile, "tok", "   ");
+        var json = EzvpnConfig.Build(profile, "ed25519-sec:key", "   ");
         using var doc = JsonDocument.Parse(json);
 
         Assert.False(doc.RootElement.TryGetProperty("relay_auth_token", out _));
@@ -70,11 +74,11 @@ public void Build_OmitsBlankRelayAuthToken()
     public void Build_RelayAuthTokenWithoutRelays_Throws()
     {
         var profile = new TunnelProfile { ServerNodeId = "node" };
-        Assert.Throws<ArgumentException>(() => EzvpnConfig.Build(profile, "tok", "relay-secret"));
+        Assert.Throws<ArgumentException>(() => EzvpnConfig.Build(profile, "ed25519-sec:key", "relay-secret"));
     }
 
     [Fact]
-    public void Build_IncludesTokenAndMaxAttempts_WhenSet()
+    public void Build_IncludesAuthKeyAndMaxAttempts_WhenSet()
     {
         var profile = new TunnelProfile
         {
@@ -82,16 +86,16 @@ public void Build_IncludesTokenAndMaxAttempts_WhenSet()
             MaxReconnectAttempts = 5,
         };
 
-        var json = EzvpnConfig.Build(profile, "v0123456789");
+        var json = EzvpnConfig.Build(profile, "ed25519-sec:AAAA");
         using var doc = JsonDocument.Parse(json);
         var root = doc.RootElement;
 
-        Assert.Equal("v0123456789", root.GetProperty("auth_token").GetString());
+        Assert.Equal("ed25519-sec:AAAA", root.GetProperty("auth_key").GetString());
         Assert.Equal(5u, root.GetProperty("max_reconnect_attempts").GetUInt32());
     }
 
     [Fact]
-    public void Build_BlankOrNullToken_Throws()
+    public void Build_BlankOrNullAuthKey_Throws()
     {
         var profile = new TunnelProfile { ServerNodeId = "node" };
         Assert.Throws<ArgumentException>(() => EzvpnConfig.Build(profile, null));
diff --git a/tests/Ezvpn.Core.Tests/TunnelValidationTests.cs b/tests/Ezvpn.Core.Tests/TunnelValidationTests.cs
index f890847..b7b2b43 100644
--- a/tests/Ezvpn.Core.Tests/TunnelValidationTests.cs
+++ b/tests/Ezvpn.Core.Tests/TunnelValidationTests.cs
@@ -24,12 +24,23 @@ public void ValidateServerNodeId_RejectsEmptyAndSpaces()
     }
 
     [Fact]
-    public void ValidateAuthToken_IsRequired()
+    public void ValidateAuthKeyId_IsRequired()
     {
-        Assert.NotNull(TunnelValidation.ValidateAuthToken(null));
-        Assert.NotNull(TunnelValidation.ValidateAuthToken(""));
-        Assert.NotNull(TunnelValidation.ValidateAuthToken("   "));
-        Assert.Null(TunnelValidation.ValidateAuthToken("v0123456789"));
+        Assert.NotNull(TunnelValidation.ValidateAuthKeyId(null));
+        Assert.NotNull(TunnelValidation.ValidateAuthKeyId(""));
+        Assert.NotNull(TunnelValidation.ValidateAuthKeyId("   "));
+        Assert.Null(TunnelValidation.ValidateAuthKeyId("6b1c9d0e"));
+    }
+
+    [Fact]
+    public void ValidateName_ReportsTheSubjectItWasGiven()
+    {
+        Assert.Contains(
+            "A key with this name already exists.",
+            TunnelValidation.ValidateName("laptop", new[] { "Laptop" }, subject: "key"));
+        Assert.Contains(
+            "A profile with this name already exists.",
+            TunnelValidation.ValidateName("work", new[] { "work" }));
     }
 
     [Theory]

From fcbf50e046823a872c6b76859828bb144be83415 Mon Sep 17 00:00:00 2001
From: Andrew Chen <hello@andrewtheguy.com>
Date: Thu, 27 Aug 2026 16:35:51 -0700
Subject: [PATCH 2/7] Address review findings on the public-key auth change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Keep copied secret keys out of clipboard history (Win+V) and off the Cloud
  Clipboard via SetContentWithOptions, so the most sensitive thing the app holds
  isn't left in a history pane or synced to the user's other machines. Public
  keys keep the ordinary clipboard path — they aren't secrets. This is the
  closest Windows equivalent of the Apple app's expiring pasteboard copy.
- Explain an emptied auth-key picker in TunnelEditDialog.SetKeys: deleting the
  selected key in the key manager and returning to the editor cleared the picker
  with no notice, since only LoadFrom raised the warning.
- Skip a credential whose stored secret is missing or null rather than throwing.
  System.Text.Json doesn't enforce non-nullable annotations, so a hand-edited
  `"secret": null` blob landed as null and the unchecked .Length made one corrupt
  record fail the whole key list. A missing name stays non-fatal — the key works
  and can be renamed.

Verified on the CI VM: build, 43 Core tests, publish and MSI all green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CWMkFDzsTTQVQsUxpzF2wN
---
 .../Services/CredentialAuthKeyStore.cs        | 15 ++++++++---
 src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs    | 25 ++++++++++++++++++-
 src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs  |  7 ++++++
 3 files changed, 42 insertions(+), 5 deletions(-)

diff --git a/src/Ezvpn.App/Services/CredentialAuthKeyStore.cs b/src/Ezvpn.App/Services/CredentialAuthKeyStore.cs
index 197e2c9..3cccc08 100644
--- a/src/Ezvpn.App/Services/CredentialAuthKeyStore.cs
+++ b/src/Ezvpn.App/Services/CredentialAuthKeyStore.cs
@@ -17,13 +17,16 @@ namespace Ezvpn.App.Services;
 /// </summary>
 public sealed class CredentialAuthKeyStore : IAuthKeyRecordStore
 {
+    // Nullable on the way in: System.Text.Json does not enforce non-nullable
+    // annotations, so an explicit `"secret": null` in a hand-edited credential
+    // would land as null however this is declared. Better to say so and check.
     private sealed class Record
     {
         [JsonPropertyName("name")]
-        public string Name { get; set; } = "";
+        public string? Name { get; set; }
 
         [JsonPropertyName("secret")]
-        public string Secret { get; set; } = "";
+        public string? Secret { get; set; }
     }
 
     public IReadOnlyList<StoredAuthKey> LoadAll()
@@ -43,9 +46,13 @@ record = JsonSerializer.Deserialize<Record>(json);
                 // rather than refusing every key.
                 continue;
             }
-            if (record is not null && record.Secret.Length > 0)
+            // A record with a missing or empty secret can never connect, so treat
+            // it as corrupt and skip it like undecodable JSON — reading its length
+            // unchecked would throw instead, taking the whole store down with it.
+            // A missing name is not fatal: the key still works and can be renamed.
+            if (record is not null && !string.IsNullOrEmpty(record.Secret))
             {
-                result.Add(new StoredAuthKey(id, record.Name, record.Secret));
+                result.Add(new StoredAuthKey(id, record.Name ?? "", record.Secret));
             }
         }
         return result;
diff --git a/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs b/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
index 539c8bb..39ca86b 100644
--- a/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
+++ b/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
@@ -148,6 +148,29 @@ private void OnCopyPublicKey(object sender, RoutedEventArgs args)
         }
     }
 
+    /// <summary>
+    /// Copy a secret key. Unlike the public half it is kept out of clipboard
+    /// history (Win+V) and off the Cloud Clipboard, so the most sensitive thing
+    /// the app holds isn't left sitting in a history pane or synced to the user's
+    /// other machines. The Apple app's expiring pasteboard copy is the same idea;
+    /// Windows has no expiry, so this is the closest equivalent.
+    /// </summary>
+    private void CopySecretToClipboard(string secret)
+    {
+        try
+        {
+            var package = new DataPackage { RequestedOperation = DataPackageOperation.Copy };
+            package.SetText(secret);
+            Clipboard.SetContentWithOptions(
+                package,
+                new ClipboardContentOptions { IsAllowedInHistory = false, IsRoamable = false });
+        }
+        catch (Exception ex)
+        {
+            ShowError($"Couldn't copy to the clipboard: {ex.Message}");
+        }
+    }
+
     /// <summary>Remember which row's confirmation is being shown.</summary>
     private void OnConfirmFlyoutOpening(object? sender, object args) =>
         _confirmKeyId = ((sender as FlyoutBase)?.Target as FrameworkElement)?.Tag as string;
@@ -157,7 +180,7 @@ private void OnCopySecretKey(object sender, RoutedEventArgs args)
         CloseFlyout(sender);
         if (ConfirmedKey() is { } key)
         {
-            CopyToClipboard(key.Secret);
+            CopySecretToClipboard(key.Secret);
         }
     }
 
diff --git a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
index e6a322e..9f6358d 100644
--- a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
+++ b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
@@ -34,6 +34,13 @@ public void SetKeys(IReadOnlyList<AuthKeyStore.Key> keys)
         var selectedId = SelectedKeyId;
         KeyBox.ItemsSource = keys;
         KeyBox.SelectedItem = keys.FirstOrDefault(k => k.Id == selectedId);
+        // A key that was selected and is now gone (deleted from the key manager
+        // this dialog just came back from) empties the picker, so explain it the
+        // same way LoadFrom does rather than leaving it blank.
+        if (selectedId is not null && KeyBox.SelectedItem is null)
+        {
+            MissingKeyBar.IsOpen = true;
+        }
         UpdatePublicKeyText();
     }
 

From 936286e5645281b146ae42b6bc4378306e5f206a Mon Sep 17 00:00:00 2001
From: Andrew Chen <hello@andrewtheguy.com>
Date: Thu, 27 Aug 2026 16:47:53 -0700
Subject: [PATCH 3/7] Add AGENTS.md for detailed notes on ezvpn-windows

---
 AGENTS.md | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 CLAUDE.md | 72 +------------------------------------------------------
 2 files changed, 72 insertions(+), 71 deletions(-)
 create mode 100644 AGENTS.md

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..54fa5c0
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,71 @@
+# ezvpn-windows — notes for Claude
+
+Native Windows GUI (WinUI 3, .NET) for the `ezvpn` VPN. Sibling of `ezvpn-apple`.
+The Rust core + C FFI live in the `../ezvpn` repo (`src/ffi_windows.rs`,
+`windows/ezvpn.h`, `build-windows.ps1`, `docs/Windows-App.md`).
+
+## Key facts
+
+- The transport is iroh (Rust-only) — never reimplement the protocol in .NET.
+  The app P/Invokes `ezvpn.dll` (`ezvpn_start` / `ezvpn_status` / `ezvpn_stop`).
+- Single elevated process: app manifest requests Administrator; the tunnel runs
+  in-process (no service, no IPC). `wintun.dll` must be beside `ezvpn.dll`.
+- `Ezvpn.Core` is `net8.0` and pure (unit-tested). `Ezvpn.App` is
+  `net10.0-windows…` WinUI 3, needs a RID to build (defaults to `win-x64`).
+- Build the whole solution with `dotnet build ezvpn-windows.slnx` (no `-r` — the
+  app has a default RID; passing `-r` to a *solution* is rejected by the SDK).
+- Native DLLs are runtime-only, so the app compiles/tests without them. They are
+  copied into output for running/packaging (from `native/`, or from
+  `..\ezvpn\dist\windows` when `EZVPN_LOCAL_DLL=1`).
+- **To check a change on Windows, run `pwsh ci/windows/remote.ps1`.** From the
+  macOS dev box (where none of this builds) it ships the *working tree* —
+  uncommitted changes included — to the Hyper-V VM (`windows-ci-build`, shared
+  with `../wrustic`) and runs build, test, publish and MSI there. `remote.ps1
+  doctor` reports the VM's toolchain, `remote.ps1 provision` (re)installs it.
+  See `docs/windows-vm-ci.md`.
+- Do **not** reach for `.github/workflows/windows-ci.yml` to find out whether
+  something works: it needs a commit and a push to trigger, and it is slow even
+  warm, because a GitHub runner starts with a cold NuGet cache every time. It
+  runs itself on push/PR — read it after the fact, don't drive it.
+  `ci\windows\ci.ps1` is the same four steps on the VM, with a warm NuGet cache;
+  when the two disagree, the workflow is right and `ci.ps1` is stale.
+
+## Conventions
+
+- The `ezvpn_start` config JSON shape is defined in `../ezvpn/windows/ezvpn.h`;
+  `EzvpnConfig.Build` produces it. Keep them in sync.
+- `ClientStatus` mirrors the Rust `ClientStatus` (snake_case) from
+  `../ezvpn/src/control.rs`.
+- The client authenticates with an **ed25519 keypair**, not a pre-shared token:
+  the config's `auth_key` is the client's `ed25519-sec:…` secret, and its public
+  half goes on the server's `authorized_keys` file. Keys are generated and parsed
+  only through the FFI (`ezvpn_generate_client_key` / `ezvpn_client_public_key`,
+  wrapped by `Core/Interop/AuthKey`) — never reimplement the key format in .NET.
+- Like the Apple and Android apps, the app keeps one shared list of **named**
+  keys (`AuthKeyStore`) that profiles reference by id (`TunnelProfile.AuthKeyId`);
+  saving a profile copies that key's secret into the profile's own credential,
+  which is what `ezvpn_start` is handed. So a key deleted from the list doesn't
+  break profiles already saved with it.
+- All secrets live in Windows Credential Manager (`SecretStore`), never in the
+  profile JSON: `ezvpn:<profileId>` (the profile's auth key), `ezvpn-relay:<profileId>`
+  (the optional relay token) and `ezvpn-key:<keyId>` (one record per named key —
+  one credential each, because a credential blob caps out at 2560 bytes).
+- Installer uses **WiX v5** (v6/v7 require accepting the paid OSMF EULA). The MSI
+  is unsigned by design; code signing and MSIX/Store packaging are out of scope.
+- Use classic `[DllImport]` (not `[LibraryImport]`) for the `advapi32`
+  Credential Manager calls — the `CREDENTIAL` struct isn't source-gen
+  marshallable.
+- Icons: `assets\icon.svg` (the shield/keyhole glyph, shared with ezvpn-apple) is
+  the source of truth. `scripts\render-icons.ps1` renders it to the committed
+  `src\Ezvpn.App\Assets\ezvpn.ico` (teal, multi-size) plus a gray
+  `ezvpn-gray.ico` via GDI+ — re-run it (needs Windows PowerShell 5.1) only when
+  the SVG changes; CI just uses the committed `.ico`s. The teal `ezvpn.ico` is
+  the `.exe` icon (`<ApplicationIcon>`) and the title-bar icon
+  (`AppWindow.SetIcon`); the tray shows `ezvpn-gray.ico` until the tunnel is
+  connected, then swaps to the teal one.
+- The system tray (`Services\TrayIcon.cs`) is hand-rolled on `Shell_NotifyIcon`
+  (WinUI 3 has no tray API): it subclasses the window's WndProc for callbacks and
+  uses a native `TrackPopupMenuEx` menu. Closing the window hides to the tray;
+  only the tray's Quit exits the process. `SetConnected(bool)` swaps between the
+  teal (connected) and gray (not-connected) icons; `MainWindow` drives it from
+  the active tunnel's connection state.
diff --git a/CLAUDE.md b/CLAUDE.md
index 54fa5c0..eef4bd2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,71 +1 @@
-# ezvpn-windows — notes for Claude
-
-Native Windows GUI (WinUI 3, .NET) for the `ezvpn` VPN. Sibling of `ezvpn-apple`.
-The Rust core + C FFI live in the `../ezvpn` repo (`src/ffi_windows.rs`,
-`windows/ezvpn.h`, `build-windows.ps1`, `docs/Windows-App.md`).
-
-## Key facts
-
-- The transport is iroh (Rust-only) — never reimplement the protocol in .NET.
-  The app P/Invokes `ezvpn.dll` (`ezvpn_start` / `ezvpn_status` / `ezvpn_stop`).
-- Single elevated process: app manifest requests Administrator; the tunnel runs
-  in-process (no service, no IPC). `wintun.dll` must be beside `ezvpn.dll`.
-- `Ezvpn.Core` is `net8.0` and pure (unit-tested). `Ezvpn.App` is
-  `net10.0-windows…` WinUI 3, needs a RID to build (defaults to `win-x64`).
-- Build the whole solution with `dotnet build ezvpn-windows.slnx` (no `-r` — the
-  app has a default RID; passing `-r` to a *solution* is rejected by the SDK).
-- Native DLLs are runtime-only, so the app compiles/tests without them. They are
-  copied into output for running/packaging (from `native/`, or from
-  `..\ezvpn\dist\windows` when `EZVPN_LOCAL_DLL=1`).
-- **To check a change on Windows, run `pwsh ci/windows/remote.ps1`.** From the
-  macOS dev box (where none of this builds) it ships the *working tree* —
-  uncommitted changes included — to the Hyper-V VM (`windows-ci-build`, shared
-  with `../wrustic`) and runs build, test, publish and MSI there. `remote.ps1
-  doctor` reports the VM's toolchain, `remote.ps1 provision` (re)installs it.
-  See `docs/windows-vm-ci.md`.
-- Do **not** reach for `.github/workflows/windows-ci.yml` to find out whether
-  something works: it needs a commit and a push to trigger, and it is slow even
-  warm, because a GitHub runner starts with a cold NuGet cache every time. It
-  runs itself on push/PR — read it after the fact, don't drive it.
-  `ci\windows\ci.ps1` is the same four steps on the VM, with a warm NuGet cache;
-  when the two disagree, the workflow is right and `ci.ps1` is stale.
-
-## Conventions
-
-- The `ezvpn_start` config JSON shape is defined in `../ezvpn/windows/ezvpn.h`;
-  `EzvpnConfig.Build` produces it. Keep them in sync.
-- `ClientStatus` mirrors the Rust `ClientStatus` (snake_case) from
-  `../ezvpn/src/control.rs`.
-- The client authenticates with an **ed25519 keypair**, not a pre-shared token:
-  the config's `auth_key` is the client's `ed25519-sec:…` secret, and its public
-  half goes on the server's `authorized_keys` file. Keys are generated and parsed
-  only through the FFI (`ezvpn_generate_client_key` / `ezvpn_client_public_key`,
-  wrapped by `Core/Interop/AuthKey`) — never reimplement the key format in .NET.
-- Like the Apple and Android apps, the app keeps one shared list of **named**
-  keys (`AuthKeyStore`) that profiles reference by id (`TunnelProfile.AuthKeyId`);
-  saving a profile copies that key's secret into the profile's own credential,
-  which is what `ezvpn_start` is handed. So a key deleted from the list doesn't
-  break profiles already saved with it.
-- All secrets live in Windows Credential Manager (`SecretStore`), never in the
-  profile JSON: `ezvpn:<profileId>` (the profile's auth key), `ezvpn-relay:<profileId>`
-  (the optional relay token) and `ezvpn-key:<keyId>` (one record per named key —
-  one credential each, because a credential blob caps out at 2560 bytes).
-- Installer uses **WiX v5** (v6/v7 require accepting the paid OSMF EULA). The MSI
-  is unsigned by design; code signing and MSIX/Store packaging are out of scope.
-- Use classic `[DllImport]` (not `[LibraryImport]`) for the `advapi32`
-  Credential Manager calls — the `CREDENTIAL` struct isn't source-gen
-  marshallable.
-- Icons: `assets\icon.svg` (the shield/keyhole glyph, shared with ezvpn-apple) is
-  the source of truth. `scripts\render-icons.ps1` renders it to the committed
-  `src\Ezvpn.App\Assets\ezvpn.ico` (teal, multi-size) plus a gray
-  `ezvpn-gray.ico` via GDI+ — re-run it (needs Windows PowerShell 5.1) only when
-  the SVG changes; CI just uses the committed `.ico`s. The teal `ezvpn.ico` is
-  the `.exe` icon (`<ApplicationIcon>`) and the title-bar icon
-  (`AppWindow.SetIcon`); the tray shows `ezvpn-gray.ico` until the tunnel is
-  connected, then swaps to the teal one.
-- The system tray (`Services\TrayIcon.cs`) is hand-rolled on `Shell_NotifyIcon`
-  (WinUI 3 has no tray API): it subclasses the window's WndProc for callbacks and
-  uses a native `TrackPopupMenuEx` menu. Closing the window hides to the tray;
-  only the tray's Quit exits the process. `SetConnected(bool)` swaps between the
-  teal (connected) and gray (not-connected) icons; `MainWindow` drives it from
-  the active tunnel's connection state.
+@AGENTS.md
\ No newline at end of file

From 39d19ddbc24efb75e3e3ad35ea1bfa25869dd748 Mon Sep 17 00:00:00 2001
From: Andrew Chen <hello@andrewtheguy.com>
Date: Thu, 27 Aug 2026 16:50:59 -0700
Subject: [PATCH 4/7] Add note on backward compatibility to AGENTS.md

---
 AGENTS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/AGENTS.md b/AGENTS.md
index 54fa5c0..8225404 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -6,6 +6,7 @@ The Rust core + C FFI live in the `../ezvpn` repo (`src/ffi_windows.rs`,
 
 ## Key facts
 
+- Strict no backward compatibility (0.0.x) or legacy code paths
 - The transport is iroh (Rust-only) — never reimplement the protocol in .NET.
   The app P/Invokes `ezvpn.dll` (`ezvpn_start` / `ezvpn_status` / `ezvpn_stop`).
 - Single elevated process: app manifest requests Administrator; the tunnel runs

From aa0c903d992e419034c99f4657645cd0b9c2e99c Mon Sep 17 00:00:00 2001
From: Andrew Chen <hello@andrewtheguy.com>
Date: Thu, 27 Aug 2026 16:53:35 -0700
Subject: [PATCH 5/7] Drop the legacy accommodations left by the key-auth
 change

Strict no backward compatibility: nothing may exist to make an older build's
data work.

- Store a profile's auth key under ezvpn-profile-key:<profileId> instead of
  reusing ezvpn:<profileId>, the target that held the pre-shared token. That
  target holds a different kind of secret, and reading one back as an ed25519 key
  only produced a baffling "must decode to 32 bytes" at connect time. A profile
  from an older build now simply has no auth key, which is what it is.
- Collapse "profile names no key" and "profile's key was deleted" into one state
  in TunnelsManager.KeyNameFor and TunnelEditDialog.LoadFrom. The empty-AuthKeyId
  branch and the AuthKeyId.Length > 0 guard existed only to tell a pre-key-auth
  profile apart from a current one; either way the profile can't be re-saved
  until a key is picked, so there is one path and one message.
- Drop the config tests' assertions that the removed auth_token and relay_only
  fields aren't emitted. Nothing emits them and no format they belong to is
  supported, so they only kept dead field names alive.

AGENTS.md records the rule.

Verified on the CI VM: build, 43 Core tests, publish and MSI all green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CWMkFDzsTTQVQsUxpzF2wN
---
 AGENTS.md                                    |  7 ++++---
 src/Ezvpn.App/Services/SecretStore.cs        | 11 ++++++++---
 src/Ezvpn.App/ViewModels/TunnelViewModel.cs  |  2 +-
 src/Ezvpn.App/ViewModels/TunnelsManager.cs   | 17 ++++++-----------
 src/Ezvpn.App/Views/TunnelEditDialog.xaml    |  2 +-
 src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs |  9 ++++-----
 tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs   |  4 ----
 7 files changed, 24 insertions(+), 28 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 8225404..633b9f0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,9 +48,10 @@ The Rust core + C FFI live in the `../ezvpn` repo (`src/ffi_windows.rs`,
   which is what `ezvpn_start` is handed. So a key deleted from the list doesn't
   break profiles already saved with it.
 - All secrets live in Windows Credential Manager (`SecretStore`), never in the
-  profile JSON: `ezvpn:<profileId>` (the profile's auth key), `ezvpn-relay:<profileId>`
-  (the optional relay token) and `ezvpn-key:<keyId>` (one record per named key —
-  one credential each, because a credential blob caps out at 2560 bytes).
+  profile JSON: `ezvpn-profile-key:<profileId>` (the profile's auth key),
+  `ezvpn-relay:<profileId>` (the optional relay token) and `ezvpn-key:<keyId>`
+  (one record per named key — one credential each, because a credential blob caps
+  out at 2560 bytes).
 - Installer uses **WiX v5** (v6/v7 require accepting the paid OSMF EULA). The MSI
   is unsigned by design; code signing and MSIX/Store packaging are out of scope.
 - Use classic `[DllImport]` (not `[LibraryImport]`) for the `advapi32`
diff --git a/src/Ezvpn.App/Services/SecretStore.cs b/src/Ezvpn.App/Services/SecretStore.cs
index 367f5f7..e196990 100644
--- a/src/Ezvpn.App/Services/SecretStore.cs
+++ b/src/Ezvpn.App/Services/SecretStore.cs
@@ -10,8 +10,8 @@ namespace Ezvpn.App.Services;
 ///
 /// Three kinds of entry live here, distinguished by target prefix:
 /// <list type="bullet">
-/// <item><c>ezvpn:&lt;profileId&gt;</c> — the profile's copy of the ed25519 auth
-/// key it connects with (what <c>ezvpn_start</c> is handed).</item>
+/// <item><c>ezvpn-profile-key:&lt;profileId&gt;</c> — the profile's copy of the
+/// ed25519 auth key it connects with (what <c>ezvpn_start</c> is handed).</item>
 /// <item><c>ezvpn-relay:&lt;profileId&gt;</c> — the optional shared relay bearer
 /// token.</item>
 /// <item><c>ezvpn-key:&lt;keyId&gt;</c> — one record of the app's named auth-key
@@ -27,7 +27,12 @@ public static class SecretStore
     /// <summary>Target prefix of the named auth-key records.</summary>
     internal const string KeyRecordPrefix = "ezvpn-key:";
 
-    private static string AuthKeyTargetFor(Guid id) => "ezvpn:" + id.ToString("N");
+    // Deliberately not the "ezvpn:<profileId>" target that held the pre-shared
+    // auth token this replaced: that credential stores a different kind of secret,
+    // and reading one back as an ed25519 key would only produce a baffling
+    // "must decode to 32 bytes" at connect time. A profile from an older build
+    // therefore has no auth key at all, which is exactly what it is.
+    private static string AuthKeyTargetFor(Guid id) => "ezvpn-profile-key:" + id.ToString("N");
     private static string RelayTargetFor(Guid id) => "ezvpn-relay:" + id.ToString("N");
 
     /// <summary>Store (or overwrite) a profile's copy of its auth key.</summary>
diff --git a/src/Ezvpn.App/ViewModels/TunnelViewModel.cs b/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
index ea23108..f496221 100644
--- a/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
+++ b/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
@@ -20,7 +20,7 @@ public sealed class TunnelViewModel : ObservableObject
     private ConnectionState _state = ConnectionState.Disconnected;
     private ClientStatus? _status;
     private string? _error;
-    private string _authKeyName = "None selected";
+    private string _authKeyName = "Not in the key list";
 
     public TunnelViewModel(TunnelProfile profile)
     {
diff --git a/src/Ezvpn.App/ViewModels/TunnelsManager.cs b/src/Ezvpn.App/ViewModels/TunnelsManager.cs
index 6f6c92b..ff17c12 100644
--- a/src/Ezvpn.App/ViewModels/TunnelsManager.cs
+++ b/src/Ezvpn.App/ViewModels/TunnelsManager.cs
@@ -178,18 +178,13 @@ private string RequireAuthKey(TunnelProfile profile) =>
             "This profile has no auth key selected. Pick one in the profile editor.");
 
     /// <summary>
-    /// How the UI names a profile's key: its name, or a notice when the key has
-    /// been deleted from the list (the profile still connects with its own copy
-    /// of the secret, but cannot be re-saved until a key is picked again).
+    /// How the UI names a profile's key: its name, or a notice when the profile
+    /// has no key in the list — because it was deleted, or because the profile
+    /// predates key auth. Those are one state, not two: either way the profile
+    /// cannot be re-saved until a key is picked.
     /// </summary>
-    private string KeyNameFor(TunnelProfile profile)
-    {
-        if (string.IsNullOrEmpty(profile.AuthKeyId))
-        {
-            return "None selected";
-        }
-        return AuthKeys.Find(profile.AuthKeyId)?.Name ?? "No longer in the key list";
-    }
+    private string KeyNameFor(TunnelProfile profile) =>
+        AuthKeys.Find(profile.AuthKeyId)?.Name ?? "Not in the key list";
 
     /// <summary>Persist (or clear) the optional relay token. A null/blank token
     /// deletes any stored item, so removing it in the editor removes the secret.</summary>
diff --git a/src/Ezvpn.App/Views/TunnelEditDialog.xaml b/src/Ezvpn.App/Views/TunnelEditDialog.xaml
index 128d4ee..c123708 100644
--- a/src/Ezvpn.App/Views/TunnelEditDialog.xaml
+++ b/src/Ezvpn.App/Views/TunnelEditDialog.xaml
@@ -42,7 +42,7 @@
 
             <InfoBar x:Name="MissingKeyBar" IsOpen="False" Severity="Warning" IsClosable="False"
                      Title="Auth key missing"
-                     Message="The auth key this profile used is no longer in the key list. Pick a key before saving." />
+                     Message="This profile doesn't name a key in the key list. Pick one before saving." />
 
             <TextBox x:Name="RelayBox" Header="Relay URLs (optional, comma-separated)"
                      PlaceholderText="https://relay.example.com"
diff --git a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
index 9f6358d..b6a605a 100644
--- a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
+++ b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
@@ -62,11 +62,10 @@ public void LoadFrom(TunnelProfile profile, string? relayToken)
 
         var keys = (IReadOnlyList<AuthKeyStore.Key>?)KeyBox.ItemsSource ?? Array.Empty<AuthKeyStore.Key>();
         KeyBox.SelectedItem = keys.FirstOrDefault(k => k.Id == profile.AuthKeyId);
-        // The profile keeps its own copy of the secret, so a key deleted from the
-        // list still connects — but there is nothing to preselect and nothing to
-        // re-save with, so say so instead of showing an empty picker with no
-        // explanation.
-        MissingKeyBar.IsOpen = profile.AuthKeyId.Length > 0 && KeyBox.SelectedItem is null;
+        // Nothing to preselect: the key was deleted from the list, or the profile
+        // predates key auth. Say so rather than showing an empty picker with no
+        // explanation — a saved profile always names a key otherwise.
+        MissingKeyBar.IsOpen = KeyBox.SelectedItem is null;
         UpdatePublicKeyText();
     }
 
diff --git a/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs b/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
index 4378c31..99812f6 100644
--- a/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
+++ b/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
@@ -27,15 +27,11 @@ public void Build_EmitsSnakeCaseKeys_AndOmitsNulls()
         Assert.Equal("10.0.0.0/8", root.GetProperty("routes")[0].GetString());
         Assert.Equal("fd00::/8", root.GetProperty("routes6")[0].GetString());
         Assert.True(root.GetProperty("auto_reconnect").GetBoolean());
-        // relay_only was removed from the core FFI config; it must not be emitted.
-        Assert.False(root.TryGetProperty("relay_only", out _));
         Assert.Equal(profile.Instance, root.GetProperty("instance").GetString());
         // Null max attempts is omitted, not emitted as null.
         Assert.False(root.TryGetProperty("max_reconnect_attempts", out _));
         // The auth key is the one required secret and is always emitted.
         Assert.Equal("ed25519-sec:key", root.GetProperty("auth_key").GetString());
-        // The pre-shared token this replaced must not linger in the config.
-        Assert.False(root.TryGetProperty("auth_token", out _));
         // No relay token was supplied, so the key is omitted.
         Assert.False(root.TryGetProperty("relay_auth_token", out _));
     }

From 302ddde2dd7ffa19c97543f0d48d43b9be8f8028 Mon Sep 17 00:00:00 2001
From: Andrew Chen <hello@andrewtheguy.com>
Date: Thu, 27 Aug 2026 17:04:43 -0700
Subject: [PATCH 6/7] Require an auth key on every profile, and make a deleted
 key recoverable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No users outside the sandbox, so nothing needs the keyless fallback: drop
TunnelProfile.AuthKeyId's "" default for `required`. A profile without a key can
no longer be built in code, and JSON omitting authKeyId fails to deserialize
instead of loading as a profile that could never connect. TunnelEditDialog
resolves the selection through RequiredKeyId, cashing in the invariant Validate
already enforces.

Deleting a key stays non-destructive and recoverable, which `required` must not
change: only that key's own credential is removed. The profile keeps its key id
and its own copy of the secret, so it goes on connecting; the editor shows no
selection with "Pick one before saving", and choosing another key repairs it. No
cascade to profiles, and no state the UI can't get out of.

Says so where it matters: the detail row now reads "Not in the key list — pick
one in Edit" rather than naming the problem without the fix, and the delete
confirmation states that profiles using the key keep connecting until re-saved.

New TunnelProfile tests cover the JSON round trip, that only the key id (never a
secret) is on disk, that a keyless profile is rejected, and that a profile whose
key was deleted survives and can be repointed at another key.

Verified on the CI VM: build, 47 Core tests, publish and MSI all green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CWMkFDzsTTQVQsUxpzF2wN
---
 src/Ezvpn.App/ViewModels/TunnelViewModel.cs  |   2 +-
 src/Ezvpn.App/ViewModels/TunnelsManager.cs   |  10 +-
 src/Ezvpn.App/Views/AuthKeysDialog.xaml      |   2 +-
 src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs |  19 +++-
 src/Ezvpn.Core/TunnelProfile.cs              |   6 +-
 tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs   |  10 +-
 tests/Ezvpn.Core.Tests/TunnelProfileTests.cs | 106 +++++++++++++++++++
 7 files changed, 139 insertions(+), 16 deletions(-)
 create mode 100644 tests/Ezvpn.Core.Tests/TunnelProfileTests.cs

diff --git a/src/Ezvpn.App/ViewModels/TunnelViewModel.cs b/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
index f496221..1305533 100644
--- a/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
+++ b/src/Ezvpn.App/ViewModels/TunnelViewModel.cs
@@ -20,7 +20,7 @@ public sealed class TunnelViewModel : ObservableObject
     private ConnectionState _state = ConnectionState.Disconnected;
     private ClientStatus? _status;
     private string? _error;
-    private string _authKeyName = "Not in the key list";
+    private string _authKeyName = "Not in the key list — pick one in Edit";
 
     public TunnelViewModel(TunnelProfile profile)
     {
diff --git a/src/Ezvpn.App/ViewModels/TunnelsManager.cs b/src/Ezvpn.App/ViewModels/TunnelsManager.cs
index ff17c12..d05bd07 100644
--- a/src/Ezvpn.App/ViewModels/TunnelsManager.cs
+++ b/src/Ezvpn.App/ViewModels/TunnelsManager.cs
@@ -178,13 +178,13 @@ private string RequireAuthKey(TunnelProfile profile) =>
             "This profile has no auth key selected. Pick one in the profile editor.");
 
     /// <summary>
-    /// How the UI names a profile's key: its name, or a notice when the profile
-    /// has no key in the list — because it was deleted, or because the profile
-    /// predates key auth. Those are one state, not two: either way the profile
-    /// cannot be re-saved until a key is picked.
+    /// How the UI names a profile's key: its name, or a notice when the key the
+    /// profile names has been deleted from the list. The profile still connects
+    /// with its own copy of the secret, but cannot be re-saved until a key is
+    /// picked again.
     /// </summary>
     private string KeyNameFor(TunnelProfile profile) =>
-        AuthKeys.Find(profile.AuthKeyId)?.Name ?? "Not in the key list";
+        AuthKeys.Find(profile.AuthKeyId)?.Name ?? "Not in the key list — pick one in Edit";
 
     /// <summary>Persist (or clear) the optional relay token. A null/blank token
     /// deletes any stored item, so removing it in the editor removes the secret.</summary>
diff --git a/src/Ezvpn.App/Views/AuthKeysDialog.xaml b/src/Ezvpn.App/Views/AuthKeysDialog.xaml
index 0e07dcb..43b3b98 100644
--- a/src/Ezvpn.App/Views/AuthKeysDialog.xaml
+++ b/src/Ezvpn.App/Views/AuthKeysDialog.xaml
@@ -76,7 +76,7 @@
                                         <Flyout Opening="OnConfirmFlyoutOpening">
                                             <StackPanel Spacing="8" MaxWidth="300">
                                                 <TextBlock TextWrapping="Wrap"
-                                                           Text="The secret key is removed from this device's key list. The server keeps trusting its public key until that's taken off the authorized_keys file." />
+                                                           Text="The secret key is removed from this device's key list. Profiles using it keep connecting with their own copy — edit one to point it at another key. The server keeps trusting the public key until that's taken off the authorized_keys file." />
                                                 <Button Click="OnDeleteKey" Content="Delete key"
                                                         Style="{ThemeResource AccentButtonStyle}" />
                                             </StackPanel>
diff --git a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
index b6a605a..658a030 100644
--- a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
+++ b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
@@ -47,6 +47,15 @@ public void SetKeys(IReadOnlyList<AuthKeyStore.Key> keys)
     /// <summary>The id of the selected auth key, or null when none is selected.</summary>
     public string? SelectedKeyId => (KeyBox.SelectedItem as AuthKeyStore.Key)?.Id;
 
+    /// <summary>
+    /// The selected key's id, for the save path only. <see cref="Validate"/>
+    /// refuses to close the dialog without a selection, so this is where that
+    /// invariant is cashed in — a profile never exists without a key.
+    /// </summary>
+    private string RequiredKeyId =>
+        SelectedKeyId ?? throw new InvalidOperationException(
+            "The profile editor was saved with no auth key selected.");
+
     /// <summary>Prefill the form from an existing profile + its stored relay token.</summary>
     public void LoadFrom(TunnelProfile profile, string? relayToken)
     {
@@ -62,9 +71,9 @@ public void LoadFrom(TunnelProfile profile, string? relayToken)
 
         var keys = (IReadOnlyList<AuthKeyStore.Key>?)KeyBox.ItemsSource ?? Array.Empty<AuthKeyStore.Key>();
         KeyBox.SelectedItem = keys.FirstOrDefault(k => k.Id == profile.AuthKeyId);
-        // Nothing to preselect: the key was deleted from the list, or the profile
-        // predates key auth. Say so rather than showing an empty picker with no
-        // explanation — a saved profile always names a key otherwise.
+        // Nothing to preselect: the key this profile names has been deleted from
+        // the list. Say so rather than showing an empty picker with no
+        // explanation — a saved profile always names a key.
         MissingKeyBar.IsOpen = KeyBox.SelectedItem is null;
         UpdatePublicKeyText();
     }
@@ -76,7 +85,7 @@ public void LoadFrom(TunnelProfile profile, string? relayToken)
     /// <summary>Build a brand-new profile and its relay token from the form (for Add).</summary>
     public (TunnelProfile Profile, string? RelayToken) BuildResult()
     {
-        var profile = new TunnelProfile();
+        var profile = new TunnelProfile { AuthKeyId = RequiredKeyId };
         ApplyTo(profile);
         return (profile, RelayToken);
     }
@@ -91,7 +100,7 @@ public void ApplyTo(TunnelProfile profile)
     {
         profile.Name = NameBox.Text.Trim();
         profile.ServerNodeId = NodeIdBox.Text.Trim();
-        profile.AuthKeyId = SelectedKeyId ?? "";
+        profile.AuthKeyId = RequiredKeyId;
         profile.RelayUrls = TunnelValidation.SplitList(RelayBox.Text);
         profile.Routes = TunnelValidation.SplitList(RoutesBox.Text);
         profile.Routes6 = TunnelValidation.SplitList(Routes6Box.Text);
diff --git a/src/Ezvpn.Core/TunnelProfile.cs b/src/Ezvpn.Core/TunnelProfile.cs
index d11cadc..92f779f 100644
--- a/src/Ezvpn.Core/TunnelProfile.cs
+++ b/src/Ezvpn.Core/TunnelProfile.cs
@@ -29,9 +29,13 @@ public sealed class TunnelProfile
     /// never here — it is copied into the profile's own credential on save (see
     /// <c>SecretStore</c>); this is only the non-secret reference the editor
     /// re-selects and the UI names the key by.
+    ///
+    /// <c>required</c>, with no default: a profile without a key cannot be built
+    /// in code, and JSON that omits <c>authKeyId</c> fails to deserialize rather
+    /// than loading as a keyless profile.
     /// </summary>
     [JsonPropertyName("authKeyId")]
-    public string AuthKeyId { get; set; } = "";
+    public required string AuthKeyId { get; set; }
 
     /// <summary>Optional relay URL hints. When empty, iroh uses its default relay map.</summary>
     [JsonPropertyName("relayUrls")]
diff --git a/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs b/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
index 99812f6..960038c 100644
--- a/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
+++ b/tests/Ezvpn.Core.Tests/EzvpnConfigTests.cs
@@ -13,6 +13,7 @@ public void Build_EmitsSnakeCaseKeys_AndOmitsNulls()
         {
             Name = "work",
             ServerNodeId = "abc123",
+            AuthKeyId = "key-1",
             Routes = { "10.0.0.0/8" },
             Routes6 = { "fd00::/8" },
             RelayUrls = { "https://relay.example/" },
@@ -42,6 +43,7 @@ public void Build_EmitsRelayAuthToken_WithCustomRelays()
         var profile = new TunnelProfile
         {
             ServerNodeId = "node",
+            AuthKeyId = "key-1",
             RelayUrls = { "https://relay.example/" },
         };
 
@@ -57,6 +59,7 @@ public void Build_OmitsBlankRelayAuthToken()
         var profile = new TunnelProfile
         {
             ServerNodeId = "node",
+            AuthKeyId = "key-1",
             RelayUrls = { "https://relay.example/" },
         };
 
@@ -69,7 +72,7 @@ public void Build_OmitsBlankRelayAuthToken()
     [Fact]
     public void Build_RelayAuthTokenWithoutRelays_Throws()
     {
-        var profile = new TunnelProfile { ServerNodeId = "node" };
+        var profile = new TunnelProfile { ServerNodeId = "node", AuthKeyId = "key-1" };
         Assert.Throws<ArgumentException>(() => EzvpnConfig.Build(profile, "ed25519-sec:key", "relay-secret"));
     }
 
@@ -79,6 +82,7 @@ public void Build_IncludesAuthKeyAndMaxAttempts_WhenSet()
         var profile = new TunnelProfile
         {
             ServerNodeId = "node",
+            AuthKeyId = "key-1",
             MaxReconnectAttempts = 5,
         };
 
@@ -93,7 +97,7 @@ public void Build_IncludesAuthKeyAndMaxAttempts_WhenSet()
     [Fact]
     public void Build_BlankOrNullAuthKey_Throws()
     {
-        var profile = new TunnelProfile { ServerNodeId = "node" };
+        var profile = new TunnelProfile { ServerNodeId = "node", AuthKeyId = "key-1" };
         Assert.Throws<ArgumentException>(() => EzvpnConfig.Build(profile, null));
         Assert.Throws<ArgumentException>(() => EzvpnConfig.Build(profile, ""));
         Assert.Throws<ArgumentException>(() => EzvpnConfig.Build(profile, "   "));
@@ -102,7 +106,7 @@ public void Build_BlankOrNullAuthKey_Throws()
     [Fact]
     public void Instance_IsStableAndAsciiSafe()
     {
-        var profile = new TunnelProfile();
+        var profile = new TunnelProfile { AuthKeyId = "key-1" };
         Assert.StartsWith("gui_", profile.Instance);
         Assert.All(profile.Instance, c => Assert.True(char.IsLetterOrDigit(c) || c == '_'));
         Assert.Equal(profile.Instance, profile.Instance); // stable
diff --git a/tests/Ezvpn.Core.Tests/TunnelProfileTests.cs b/tests/Ezvpn.Core.Tests/TunnelProfileTests.cs
new file mode 100644
index 0000000..fcba5a7
--- /dev/null
+++ b/tests/Ezvpn.Core.Tests/TunnelProfileTests.cs
@@ -0,0 +1,106 @@
+using System.Text.Json;
+using Ezvpn.Core;
+using Xunit;
+
+namespace Ezvpn.Core.Tests;
+
+public class TunnelProfileTests
+{
+    private static TunnelProfile Sample() => new()
+    {
+        Name = "work",
+        ServerNodeId = "abc123",
+        AuthKeyId = "key-1",
+        RelayUrls = { "https://relay.example/" },
+        Routes = { "10.0.0.0/8" },
+        Routes6 = { "fd00::/8" },
+        MaxReconnectAttempts = 5,
+    };
+
+    [Fact]
+    public void RoundTripsThroughJson()
+    {
+        var profile = Sample();
+
+        var restored = JsonSerializer.Deserialize<TunnelProfile>(JsonSerializer.Serialize(profile));
+
+        Assert.NotNull(restored);
+        Assert.Equal(profile.Id, restored!.Id);
+        Assert.Equal("work", restored.Name);
+        Assert.Equal("abc123", restored.ServerNodeId);
+        Assert.Equal("key-1", restored.AuthKeyId);
+        Assert.Equal(profile.RelayUrls, restored.RelayUrls);
+        Assert.Equal(profile.Routes, restored.Routes);
+        Assert.Equal(profile.Routes6, restored.Routes6);
+        Assert.Equal(5u, restored.MaxReconnectAttempts);
+        Assert.Equal(profile.Instance, restored.Instance);
+    }
+
+    [Fact]
+    public void SerializedShapeCarriesTheKeyIdAndNoSecret()
+    {
+        using var doc = JsonDocument.Parse(JsonSerializer.Serialize(Sample()));
+
+        Assert.Equal("key-1", doc.RootElement.GetProperty("authKeyId").GetString());
+        // The key's secret lives in Credential Manager; only the id is on disk.
+        Assert.DoesNotContain(
+            "ed25519", JsonSerializer.Serialize(Sample()), StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void AProfileSurvivesDeletingTheKeyItNames_AndCanBeRepointed()
+    {
+        var storage = new FakeRecordStore();
+        var keys = new AuthKeyStore(storage, FakeDerive);
+        keys.Add("laptop", "ed25519-sec:AAAA", out var laptop);
+        keys.Add("desktop", "ed25519-sec:BBBB", out var desktop);
+
+        var profile = Sample();
+        profile.AuthKeyId = laptop!.Id;
+        Assert.Null(keys.Delete(laptop.Id));
+
+        // Deleting a key removes only that key: the profile still loads, still
+        // names the key it was saved with, and keeps every other setting.
+        var restored = JsonSerializer.Deserialize<TunnelProfile>(JsonSerializer.Serialize(profile))!;
+        Assert.Equal(laptop.Id, restored.AuthKeyId);
+        Assert.Equal("abc123", restored.ServerNodeId);
+        Assert.Single(keys.Keys);
+
+        // The editor shows no selection for it, and picking another key repairs
+        // the profile — the id is just a reference, nothing cascades.
+        Assert.Null(keys.Find(restored.AuthKeyId));
+        restored.AuthKeyId = desktop!.Id;
+        Assert.Equal("desktop", keys.Find(restored.AuthKeyId)?.Name);
+    }
+
+    /// <summary>Stand-in for the FFI derivation, as in <c>AuthKeyStoreTests</c>.</summary>
+    private static string? FakeDerive(string secret) =>
+        secret.StartsWith("ed25519-sec:", StringComparison.Ordinal)
+            ? "ed25519-pub:" + secret["ed25519-sec:".Length..]
+            : null;
+
+    private sealed class FakeRecordStore : IAuthKeyRecordStore
+    {
+        private readonly Dictionary<string, StoredAuthKey> _records = new();
+
+        public IReadOnlyList<StoredAuthKey> LoadAll() => _records.Values.ToList();
+
+        public void Save(StoredAuthKey record) => _records[record.Id] = record;
+
+        public void Delete(string id) => _records.Remove(id);
+    }
+
+    [Fact]
+    public void AProfileWithoutAKeyDoesNotDeserialize()
+    {
+        // AuthKeyId is required with no default, so JSON that omits it fails
+        // rather than loading as a keyless profile that could never connect.
+        var json = """
+            {"id":"6b1c9d0e-0000-0000-0000-000000000000","name":"work",
+             "serverNodeId":"abc123","relayUrls":[],"routes":[],"routes6":[],
+             "autoReconnect":true}
+            """;
+
+        Assert.Throws<JsonException>(() => JsonSerializer.Deserialize<TunnelProfile>(json));
+    }
+}

From b756b2cb429768a06079d777f5017ff3721c6abe Mon Sep 17 00:00:00 2001
From: Andrew Chen <hello@andrewtheguy.com>
Date: Thu, 27 Aug 2026 17:20:05 -0700
Subject: [PATCH 7/7] Fix the key picker missing new keys, and clicks lost to a
 rebuild
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two UI bugs found in review, both in the "add a key, then use it" flow.

AuthKeyStore hands out its own live List, so TunnelEditDialog.SetKeys was
re-assigning ItemsSource the very same instance it already held. A plain
List raises no collection-change notifications and setting a dependency
property to its current value is a no-op, so a key added through "Manage
keys…" never reached the picker — which is the whole fresh-install path.
Assign a snapshot instead, so the identity always changes.

The keys dialog rebuilt every row whenever a name box lost focus, even
when the name was unchanged. Clicking a row's copy or delete button moves
focus first, so the rebuild removed that button before the click landed
and the action was silently dropped. Only rebuild for an actual rename
(which re-sorts the list), and defer it past the current input event.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CWMkFDzsTTQVQsUxpzF2wN
---
 src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs   | 15 ++++++++++++++-
 src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs |  9 +++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs b/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
index 39ca86b..3a909ea 100644
--- a/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
+++ b/src/Ezvpn.App/Views/AuthKeysDialog.xaml.cs
@@ -118,6 +118,17 @@ private void OnKeyNameLostFocus(object sender, RoutedEventArgs args)
             return;
         }
 
+        // Merely leaving a name box is not a rename. Rebuilding anyway would
+        // tear down every row, including the copy/delete button the user is in
+        // the middle of clicking (the click moves focus here first), swallowing
+        // the action they asked for.
+        var current = _store.Find(id)?.Name;
+        if (current is not null && box.Text.Trim() == current)
+        {
+            box.Text = current;
+            return;
+        }
+
         var error = _store.Rename(id, box.Text);
         if (error is not null)
         {
@@ -125,7 +136,9 @@ private void OnKeyNameLostFocus(object sender, RoutedEventArgs args)
             box.Text = _store.Find(id)?.Name ?? box.Text;
             return;
         }
-        Rebuild();
+        // A real rename does have to rebuild (the list is sorted by name), but
+        // only once the input event that moved focus has been delivered.
+        DispatcherQueue.TryEnqueue(Rebuild);
     }
 
     private void OnKeyNameKeyDown(object sender, KeyRoutedEventArgs args)
diff --git a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
index 658a030..d744fb3 100644
--- a/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
+++ b/src/Ezvpn.App/Views/TunnelEditDialog.xaml.cs
@@ -32,8 +32,13 @@ public TunnelEditDialog()
     public void SetKeys(IReadOnlyList<AuthKeyStore.Key> keys)
     {
         var selectedId = SelectedKeyId;
-        KeyBox.ItemsSource = keys;
-        KeyBox.SelectedItem = keys.FirstOrDefault(k => k.Id == selectedId);
+        // Snapshot, never the caller's list: the store hands out its own live
+        // list, which raises no collection-change notifications, so re-assigning
+        // that same instance would leave the picker showing the items it was
+        // built from — a key just added in the key manager would never appear.
+        var snapshot = keys.ToArray();
+        KeyBox.ItemsSource = snapshot;
+        KeyBox.SelectedItem = snapshot.FirstOrDefault(k => k.Id == selectedId);
         // A key that was selected and is now gone (deleted from the key manager
         // this dialog just came back from) empties the picker, so explain it the
         // same way LoadFrom does rather than leaving it blank.