---
title: "Tauri"
description: "Use the Tauri updater for MainSDK desktop app updates - signed updates, update manifests, minimum versions on the server, main.yaml and testing."
section: "integrations"
canonical: "https://mainsdk.dev/docs/integrations/tauri"
updated: "2026-10-28"
---

# Tauri

> Use the Tauri updater for MainSDK desktop app updates - signed updates, update manifests, minimum versions on the server, main.yaml and testing.

Canonical: https://mainsdk.dev/docs/integrations/tauri · Updated: 2026-10-28

The Tauri driver serves [`updates`](https://mainsdk.dev/docs/interfaces/updates) for desktop apps built with Tauri, through Tauri's updater plugin. Updates are signed and install silently or after a prompt; versions you block show an "Update required" screen and your server refuses them. Pick it when your desktop app is built with Tauri, which is MainSDK's first desktop target.

> **Note:** `updates` has no spec yet. The calls and options on this page are provisional, taken from the catalog and the product requirements, and may change when the spec lands.

## Interfaces it serves

### App updates and version blocking (`updates`)

- Status: Building for 0.7 · ships as a beta API
- Driver: `tauri` (Tauri updater). 1.1; wraps the Tauri updater plugin by shape
- Docs: https://mainsdk.dev/docs/interfaces/updates.md

```yaml
updates:
  driver: tauri
```

Swap to another provider: `local`, `expo-updates`, `google-play`, `app-store`.

## Before you start

1. **Add the updater plugin** to your Tauri app, following Tauri's updater guide.
2. **Generate an update signing key pair** with the Tauri CLI. The public key goes in your Tauri configuration and ships inside the app; the private key signs each release. The updater refuses an update whose signature does not verify.
3. **Keep the private key out of the repo.** Put it and its password in your secrets manager or CI secrets, and sign in CI.
4. **Host the update metadata.** The updater reads an endpoint that describes the latest version, its download URLs and signatures; serve it from your release host.

## Configure

Set the driver for your desktop build:

```yaml title="main.yaml"
updates:
  driver: tauri
  # [TBD] the desktop target's name in main.yaml, and how the update endpoint, silent or prompted mode and the minimum version are declared
```

The signing key is used when you build releases, not by your running app. If a MainSDK setting ever needs it, it goes in as `secret:TAURI_SIGNING_PRIVATE_KEY` (suggested name), never as a literal.

## Use it

```ts title="src/startup.ts"
import { updates } from "mainsdk";

export async function onStartup() {
  const u = await updates.check();
  if (u.required) showUpdateScreen(u);   // blocked version: update before continuing
}
```

`updates.minVersion()` sets the oldest version you still accept. The change is audited and the server refuses older versions. Its arguments arrive with the spec.

## Local development and testing

- **Try the flow locally:** build two signed versions and point the updater at a local endpoint that advertises the newer one.
- **Tests:** `createTestApp()` from `@mainsdk/testing` runs `updates` on an in-memory fake, and `chaos.on("updates", { outage: true })` simulates the update endpoint being down. Helpers to set a minimum version on the fake arrive with the spec.

## What MainSDK adds on top

- Signed updates only.
- Blocking enforced by the server as well as the app, so a patched binary cannot skip it.
- Blocked users can still export their data.
- Every change to the minimum version audited.

See [App updates and version blocking](https://mainsdk.dev/docs/interfaces/updates) for the full contract.

## Limits and notes

- Planned driver, not in a spec yet: `updates` is phase 2, and desktop targets are phase 3.
- Desktop builds should also be code-signed and notarized for each operating system; that is separate from update signing.
- If you lose the update signing key, installed apps cannot verify new updates. Back it up.
- Electron apps are supported as a desktop target; an Electron updater driver is not in the catalog yet.

## Swap to or from it

```yaml title="main.yaml"
updates:
  driver: tauri   # was expo-updates
```

Your `updates.check()` and `updates.minVersion()` calls stay the same.

## FAQ

**Why must Tauri updates be signed?** The updater checks each download against the public key built into the app, so an attacker who controls the download host still cannot push a build.

**Silent or prompted?** Both are supported by the design. How you choose between them in `main.yaml` is [TBD].

## Next

- [App updates and version blocking](https://mainsdk.dev/docs/interfaces/updates)
- [App Store](https://mainsdk.dev/docs/integrations/app-store), [Google Play](https://mainsdk.dev/docs/integrations/google-play) and [Expo](https://mainsdk.dev/docs/integrations/expo)