Browser sync

These routes are at /v1/me/browser-sync, reachable only with Cactive Browser's own sign-in (a browser token): organization keys, Caity and the other apps get 403. Bookmarks, history and settings are encrypted in the browser before they're sent, under a key only your browsers hold, so the server keeps ciphertext, padded sizes and a little metadata (when records changed, which browsers synced).

Signed writes. Reads need only the sign-in. Every request that changes something carries X-Sync-Signature: t=<epoch milliseconds>,d=<device id>,s=<signature>: an Ed25519 signature (base64url) by the sync key over these lines:

cactive-browser-sync/v1/request
<METHOD>
<path>
<t>
<device id>
<base64url SHA-256 of the exact body, or of "" without one>

t must be within 5 minutes of the server's clock (otherwise 403 with code: "clock" and serverTime). Turning sync on is signed with the new sync key itself; a browser that was removed gets 403 with code: "device_removed".

Versions. Every record write names the version it replaces (baseVersion, 0 for a new record); a stale one gets conflict with the current record, and the browser keeps the later change.

Adding a browser. A browser asks to be added (POST /pairings, its one-off public key) and shows a code; a synced browser answers with the keyset sealed for it, mixing in the code the person typed. Or the recovery key opens the keyset sealed under it. The server never sees the code, the recovery key or the keyset.

Resets. POST /reset asks for a reset when no browser and no recovery key can open sync any more: after 7 days, unless a synced browser cancels it, the session alone may purge it. The account's email address is told when sync is turned on, a browser is added and a reset is asked for.

Every route below, with its parameters, request and response, errors and samples, is in the API reference.