---
title: TunnelIdentity
description: "What a launcher keeps to verify its VM: the host's secret seed and the VM's public key, both base64."
---

```python
@final
class TunnelIdentity
```

What a launcher keeps to verify its VM: the host's secret seed and the VM's public key,
both base64.

From `Sandbox.tunnel_identity` after a `run(identity=True)`, from a `NameRecord`, or built
from the two values `microvm run --identity` prints. Holds a secret: `host_seed` stays out
of `repr`; store it only where the agent token goes.

## Constructor

```python
TunnelIdentity(host_seed: str, vm_public_key: str)
```

Rebuilds the pair from its base64 spellings. Refuses a value that doesn't decode, or a
seed or key of the wrong length.

## Properties

### `host_seed`

```python
host_seed: str
```

The host's secret half, base64. Store only privately; never in repr.

### `vm_public_key`

```python
vm_public_key: str
```

The VM's public key, base64: the pin. Safe to print and compare.

## Special methods

### `__eq__`

```python
def __eq__(other: object, /) -> bool
```

### `__repr__`

```python
def __repr__() -> str
```

## Provenance

This page is generated from `bindings/microvms-py/microvms.pyi` by Griffe 2.3.0, run from `site/scripts/gen-reference.mjs` on every `pnpm run sync`, so an edit made here is overwritten by the next run.

To change the page, change the doc comment in the binding's Rust source, then regenerate the declarations with `mise run stubs`. `mise run stubs:check` fails when the committed file no longer matches the source.