What is a Matter fabric, and how does multi-admin work?

A Matter fabric is a security domain. Google’s Matter primer defines it as the set of devices in a network that share the same security domain, identified by a root certificate authority and a unique 64-bit Fabric ID. Devices in the same fabric can authenticate each other and talk securely. Devices in different fabrics cannot, unless they also share a fabric.

Within a fabric, each node is identified by a Node Operational Certificate (NOC), the credential it uses to identify itself and communicate within that fabric, and by a 64-bit node ID. In practice, an ecosystem such as Google Home or Apple Home runs the certificate authority for its fabric, and its hubs and apps are the controllers. An app that runs its own fabric takes on that certificate authority role itself, which how to build a Matter controller app weighs against using an ecosystem’s fabric.

A fabric is separate from the device’s factory identity. The Connectivity Standards Alliance (CSA) explains that each Matter device has a unique identity, backed by a Device Attestation Certificate issued under root certificate authorities run by Alliance members. That certificate proves a device is a genuine certified product. The operational certificate a device receives when it joins a fabric is what it uses from then on.

A device joins its first fabric through commissioning. The commissioner, usually a phone app or hub, uses the setup code to open a secure session with the new device, checks its attestation certificate, and has the device generate an operational key pair. The fabric’s certificate authority signs a Node Operational Certificate for that key, and the private key never leaves the device. What is Matter? walks through each step.

Multi-admin is a device being commissioned onto more than one fabric. Google’s primer says each fabric then operates independently, and the CSA describes multi-admin as one of the core features that lets users connect their Matter devices to multiple platforms, apps or other control points.

A smart plug in a household that uses both Apple Home and Alexa is a typical case. The plug holds two operational certificates, one per fabric, and answers to controllers in both. Its data model, the on/off state and the rest, is shared: switching it off from either app switches it off for both.

Every certified Matter device must support at least five fabrics. The Operational Credentials cluster in the Matter 1.6.1 data model sets the SupportedFabrics attribute between 5 and 254. The open-source SDK’s default configuration, CHIP_CONFIG_MAX_FABRICS, is 16 as of SDK version 1.6.1.0. The number a particular product supports is up to its maker, and memory on small devices is the usual limit.

Sharing a device starts with asking the first ecosystem to let another one in. The SDK’s chip-tool guide describes the mechanism: an administrator on the existing fabric opens a commissioning window on the device, which produces a new manual pairing code and QR code payload. The second ecosystem commissions the device with that code before the window closes, and creates its own fabric on it.

Each app wraps this in its own steps. Home Assistant’s documentation has you choose “Share device” in the app that already controls the device and enter the resulting code in Home Assistant. On Apple platforms, Apple says any app that supports Matter can request access to accessories that were previously paired with other ecosystems’ apps and are stored in iOS Settings.

Two releases changed this flow:

• Matter 1.4 (November 2024) added Enhanced Multi-Admin. The CSA says it lets existing and new devices connect to multiple ecosystems automatically after a single user consent.
• Matter 1.6 (June 2026) added Joint Fabric. The CSA says it lets multiple user-authorised controllers co-administer one shared Matter network, with a central datastore that makes any device added to it accessible to all participating controllers.

The Operational Credentials cluster defines a RemoveFabric command, which deletes one fabric’s credentials from the device and leaves the others in place. Apps expose it as removing the device from one service. Apple’s Home app, for example, lets you remove an accessory from one connected service or from all of them, and says that removing a service means losing the ability to control the accessory from that service’s app.

Matter 1.4.2 (August 2025) added Vendor ID verification, which the CSA says lets controllers cryptographically verify that the administrators installed on a device really come from the vendors they claim, along with access restriction lists and standard certificate revocation lists for Device Attestation Certificates. Matter 1.6 (June 2026) split those revocation lists into smaller partitions that can be updated independently.

A fabric identifies nodes, not people. Its certificates say which devices and controllers belong to one ecosystem’s domain on one device. Which people may use that ecosystem, and what each of them may do, is decided by the ecosystem’s own accounts and apps, outside the fabric. Fabrics also live inside one home’s network: they are not designed as a way for devices owned by different organisations to verify each other on a work site.

Offline Protocol uses a different identity model from Matter fabrics, for a different job. Each device holds an Ed25519 key pair and its address is derived from the public key, so two devices can verify each other directly with no certificate authority and no connection. Devices then talk in MLS-encrypted groups, and an app can bind a device’s key to an OfflineID account through a signed challenge. It is built for apps on phones, computers and gateways that need to trust each other across sites and organisations. It does not issue Matter operational certificates, and it is not a way to join a Matter fabric.