1 files changed, 20 insertions, 0 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index 34baf45..c5ea34d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -88,6 +88,26 @@ def hub_public_key_pem() -> bytes:
     return _hub_pk_pem
 
 
+def hub_private_key_pem() -> bytes:
+    if _hub_sk_pem is None:
+        raise RuntimeError("Hub keypair not loaded — call load_hub_keypair() first")
+    return _hub_sk_pem
+
+
+def hub_id() -> str:
+    """This hub's configured identity.
+
+    An accessor, not the module global, because `load_hub_keypair` runs at
+    startup and every one of these is set *after* import. A module that wrote
+    `from meshbay_hub.auth import _hub_id` captured the default and kept it:
+    `federation.py` did, so it signed with a `None` key and announced itself
+    as `meshbay.org` whatever its configuration said. Reading through a
+    function is what makes "call once at startup" true for readers as well as
+    for the writer.
+    """
+    return _hub_id
+
+
 # ── Password ──────────────────────────────────────────────────────────────────
 
 def hash_password(password: str) -> tuple[bytes, bytes]: