---
title: TunnelIdentity
description: "What a launcher keeps to verify its VM: the host's secret seed and the VM's public key, both base64."
---

What a launcher keeps to verify its VM: the host's secret seed and the VM's public key,
both base64.

From `sandbox.tunnelIdentity()` after a `run({ identity: true })`, from a `NameRecord`, or
built from the two values `microvm run --identity` prints. Holds a secret: `hostSeed()` is a
method rather than a getter so it's never read by accident, and `toString()` leaves it out.

## Constructors

### Constructor

```ts
new TunnelIdentity(hostSeed: string, vmPublicKey: string): TunnelIdentity;
```

Rebuilds the pair from its base64 spellings. Refuses a value that doesn't decode, or a
seed or key of the wrong length.

#### Parameters

| Parameter | Type |
| ------ | ------ |
| `hostSeed` | `string` |
| `vmPublicKey` | `string` |

#### Returns

`TunnelIdentity`

## Accessors

### vmPublicKey

#### Get Signature

```ts
get vmPublicKey(): string;
```

The VM's public key, base64: the pin. Safe to print and compare.

##### Returns

`string`

## Methods

### hostSeed()

```ts
hostSeed(): string;
```

The host's secret half, base64. Store only privately.

#### Returns

`string`

***

### toString()

```ts
toString(): string;
```

The pair without its secret.

#### Returns

`string`

## Provenance

This page is generated from `bindings/microvms-js/index.d.ts` by TypeDoc 0.28.20 and typedoc-plugin-markdown 4.13.1, run from `site/scripts/gen-reference.mjs` on every `pnpm run sync`, so an edit made here is overwritten by the next run.

To change the page, change the doc comment in the binding's Rust source, then regenerate the declarations with `mise run dts`. `mise run dts:check` fails when the committed file no longer matches the source.