@andamio/login

Social login for Cardano apps. Your users sign in with Google / X / Discord and get a non-custodial wallet (powered by utxos.dev) — in one call. No utxos.dev signup, no chain provider, no seed phrases.

This is the login / wallet piece. To call Andamio's API (build & submit transactions), your backend uses your Andamio API key server-side — that's a separate concern from login.

Install

npm install @andamio/login

Use

import { createAndamioLogin } from "@andamio/login";

// { projectId, networkId } is resolved by YOUR backend from the Andamio gateway
// (see "Resolving config") and handed to the browser. The package never hardcodes
// it — if Andamio later moves you to a dedicated project, nothing here changes.
const wallet = await createAndamioLogin({ projectId, networkId });

const address   = await wallet.getBech32Address();
const signature = await wallet.signData(address, nonce);   // sign a login-challenge nonce
const signedTx  = await wallet.signTx(unsignedTxCborHex);  // sign an Andamio-built tx

That's the whole login. Signing happens in an isolated browser iframe — neither your app nor Andamio can access the user's key.

Resolving config

createAndamioLogin takes { projectId, networkId } resolved from the Andamio gateway, not a hardcoded constant:

GET {ANDAMIO_API_URL}/issuer/v1/config          header: X-API-Key: <your enterprise key>
→ { "project_id": "…", "network_id": "preprod" }

Despite the _id suffix, network_id is the string "preprod" | "mainnet" — not a number. The Cardano/SDK numeric id (0/1) is mapped inside this package and never appears in the gateway contract.

• Call it from your backend, with your enterprise API key. That key is a server-side secret and must not reach the browser — your backend resolves the config (project_id → projectId, network_id → networkId) and hands { projectId, networkId } to the page.
• Resolve once and cache it. The value is static per key, so fetch it at startup (or once, lazily) and reuse it. Do not call the endpoint on every login — that's a needless request per sign-in.

Why a lookup instead of a constant: it lets Andamio move a tenant onto their own utxos.dev project later (isolated usage limits + origin allowlist) as a backend-only change — your integration never changes.

API

createAndamioLogin(config): Promise<AndamioWallet>

• config.projectId: string — from GET /issuer/v1/config's project_id.
• config.networkId: "preprod" | "mainnet" — from GET /issuer/v1/config's network_id (mapped to the SDK's 0/1 internally).

AndamioWallet

• getBech32Address(): Promise<string>
• signData(address, payload): Promise<{ key, signature }>
• signTx(unsignedTx, partialSign?): Promise<string>

Notes

• Sponsored / gateway transactions are built and submitted by your backend against the Andamio gateway with your API key; this package only signs.