Onboarding guide
This quick guide helps users unbox, initialize, and connect their Trezor device to Harbor. It covers common pitfalls and recovery advice.
Unbox & inspect
Check for tamper-evident seals. If packaging is opened, contact the vendor. Do not initialize a device that looks tampered.
Create a seed
Generate the mnemonic on-device. Record it on paper or metal. Do not photograph or store the seed digitally. Consider Shamir backups for distributed recovery.
Connect to Bridge
Visit the application’s onboarding page, choose "Connect device," and follow the prompts. Bridge will verify the device attestation and firmware signature before allowing account enumeration.
Signing best practices
Always verify the amount and recipient on the device screen. Harbor displays a condensed summary; the device shows the full details. If any detail differs, reject the signature request.
Developer notes
Harbor exposes a small, secure API for applications. The core ideas: keep the host untrusted, require human confirmation, and bind rich context into signatures.
Example flow (conceptual)
// Host constructs payload
const payload = { network:'bitcoin', amount:100000, recipient:'1A2b...Z9', nonce:Math.random().toString(36) };
// Host -> device: SIGN_REQUEST(payload)
// Device displays payload summary; user approves
// Device -> host: SIGN_RESPONSE(signature)
Security checklist for developers
- Validate device attestation before exposing advanced features.
- Bind network and nonce into signatures to prevent cross-chain replay.
- Rate-limit signing requests and require re-authentication for bulk operations.