# `RequestSeal.KeyHandle`
[🔗](https://github.com/baselabs/request_seal/blob/v0.5.2/lib/request_seal/key_handle.ex#L1)

Caller-owned, algorithm-bound signing, verification, or key-unwrapping capability.

Construct handles through a custodian such as `RequestSeal.Custody.Local` or
`RequestSeal.Custody.SSHAgent`. Only that custodian interprets `ref`. Local
references contain only a holder PID and token, never key material. The holder
is sensitive and lives until `RequestSeal.Custody.Local.release/1` or creator exit,
including after handle transfer. Dropping a handle does not stop its holder.
A long-lived owner such as a GenServer must release handles it no longer needs,
or create handles once at startup and reuse them for its lifetime.
`RequestSeal.Custody.Local.Owner` supplies a caller-supervised owner for
explicitly encoded Ed25519 sources. Fetch a fresh handle for each operation,
or fetch again and retry once on `:key_not_found` after owner restart.

Loading the library starts no process or store. Local construction starts one
holder per handle. An asymmetric public key is obtained through
`RequestSeal.Custody.public_key/1`; HMAC has no public export.

# `t`

```elixir
@type t() :: %RequestSeal.KeyHandle{
  algorithm: RequestSeal.Custody.algorithm(),
  capabilities: [:sign | :verify | :unwrap],
  custodian: module(),
  ref: (-> term())
}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*