Devices and members

There is no bae account. Each person in a library has their own keys, which all their devices share and keep in the operating system’s keyring; the library recognizes people by those keys. Every change to who belongs is signed and kept in the cloud home, with no one in the middle.

Two different doors, for two different situations:

• Adding a device: your own new or reinstalled device joins with your restore code. No other device approves it: the code holds your keys, so it already proves the device is yours.
• Joining: another person joins with an invite from an admin, who approves their request.

Adding your own device

On a new Mac or Android phone, choose Scan code or Enter code on the first screen. Give it your restore code in one of three ways:

• Scan the QR code that one of your other devices shows: in Settings, Library, People and devices, choose Add… under Your devices.
• Pick it from iCloud Keychain, on Apple devices: bae lists the restore codes your other devices saved there.
• Paste or type it.

Sign in to the storage provider when asked. On S3 the device also needs your access key: the QR code carries it beside the code, so scanning is enough, and a typed code asks for the key. The new device then downloads the library and starts syncing.

Until it has loaded the library, the device shows where the library is stored rather than its name: the account’s email for Dropbox and OneDrive, the bucket and endpoint for S3, or iCloud. Once loaded, it shows the library’s current name.

Inviting a person

An admin opens Settings, Library, Invite a person…, enters the person’s name, role, and account email (on S3, an access key made for them instead), and picks In person or Send. bae shares the library’s folder with that account and shows the invite as a QR code.

On their device, the person chooses Scan code or Enter code, scans or pastes the invite, and signs in to their own account. An invite given in person lets them in as soon as their request arrives. For a sent invite, the admin’s device shows the request with a confirmation number, the same one the person’s device shows, and the admin compares them and chooses Approve or Decline. Once approved, the new device downloads the library, and every device shows the new person by name. An invite given in person lasts an hour, a sent one an hour, a day, or a week, and only the device that made it can approve its request. Details in Identity and membership.

Members and roles

Settings, Library lists every person and their devices, and which one is this device. The person who connects a library to the cloud is its first admin; an admin invites others as admins or members and can change a person’s role. Everyone reads and edits the library. Only admins invite and remove people and rename the library.

Removing a device

Each person can remove their own devices, and an admin can remove anyone’s, so a person who lost every device isn’t stuck. From then on, nothing the removed device sends counts. bae also shows what is left to do at the provider, such as signing that device out of your account: Dropbox, OneDrive, and iCloud can’t cut off one device of an account on their own.

Removing a person, which only an admin can do, also removes their devices and what they kept private. Their ratings, history, and playlists shared with the household stay, credited to them. The library’s keys are replaced, so nothing written afterward is readable to them. What they already copied they keep: nothing can unsend data.

Restore codes

A restore code holds your keys for one library and where it is stored, in one string. It holds no storage password or sign-in, and no library name. Show code under Your restore code in Settings, Library displays it; store it somewhere safe, like a password manager.

On Apple platforms the code is also kept in iCloud Keychain automatically, so a new Mac or iPhone signed in to your Apple Account can pick it from a list.

Anyone holding the code and access to your storage can open the library as you, so keep it secret.

Locking

The library’s encryption key lives in the operating system’s keyring. While the keyring is locked, for example while your session is locked, bae shows the library as locked and opens it once the keyring unlocks; Try again retries by hand.

On the phone

iOS and Android join and restore exactly this way; it’s their whole onboarding. A phone can also remove the library from itself: it first removes itself from the library’s members, which needs a connection to your storage, then deletes its local copy. The library in the cloud stays.