@authproof/sdk

Replace API keys with signed, non-replayable requests. Each agent gets its own cryptographic identity — no shared secrets on the wire.

Install

npm install @authproof/sdk

Quick start — sign requests in 3 lines

import { createAuthProofClient, privateKeyToWallet } from "@authproof/sdk";

const client = createAuthProofClient({
  wallet: privateKeyToWallet(process.env.AGENT_PRIVATE_KEY, 84532)
});

// Every request is signed, nonce-protected, and attributable
const res = await client.signedFetch("https://api.example.com/orders", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ sku: "hoodie-001" })
});

No API key transmitted. The private key never leaves the agent's environment.

Agent self-registration

Agents can generate their own wallet and register with an API — no human in the loop:

import { bootstrap } from "@authproof/sdk";

const { client, privateKey, walletAddress } = await bootstrap({
  server: "https://api.example.com",
  projectId: "proj_abc123",
  name: "research-agent"
});

// Save privateKey for future runs — it's shown once
await client.signedFetch("https://api.example.com/data", { method: "GET" });

Auto-pay for 402 responses

When credits run out, the SDK can automatically pay with on-chain USDC and retry:

import { createAuthProofClient, privateKeyToWallet, createAutoPayment } from "@authproof/sdk";

const client = createAuthProofClient({
  wallet: privateKeyToWallet(process.env.AGENT_PRIVATE_KEY, 84532),
  payment: {
    handler: createAutoPayment(process.env.AGENT_PRIVATE_KEY, "https://mainnet.base.org"),
    onPayment: (result) => console.log(`Paid ${result.amount} — tx: ${result.txHash}`)
  }
});

// If the server returns 402, the SDK pays and retries automatically
const res = await client.signedFetch("https://api.example.com/paid-endpoint", {
  method: "POST"
});

How it works

1. Agent has a wallet (private key) — generated locally or via bootstrap()
2. signedFetch signs each request per ERC-8128 (IETF RFC 9421 HTTP Message Signatures)
3. Server verifies the signature against the agent's known public address
4. Each signature includes a random nonce and 60-second expiry — replays are rejected
5. If the server returns 401 with accept-signature, the SDK auto-retries with the server's preferred options

API

createAuthProofClient(options)

Creates a signing client.

createAuthProofClient({
  wallet: AuthProofWallet,     // from privateKeyToWallet() or walletClientToSigner()
  fetch?: typeof fetch,        // custom fetch (for testing)
  nonceManager?: NonceManager, // custom nonce generation
  payment?: {                  // optional auto-pay for 402 responses
    handler: PaymentHandler,
    onPayment?: (result: PaymentResult) => void
  }
})

Returns { signedFetch, signRequest }.

privateKeyToWallet(privateKey, chainId)

Create a wallet from a hex-encoded private key. Simplest path for agents.

const wallet = privateKeyToWallet("0xabc...", 84532);

walletClientToSigner(viemWalletClient)

Adapt a Viem WalletClient for use with the SDK. For browser/MetaMask flows.

bootstrap(options)

Agent self-provisioning — generates a wallet, registers with a project, returns a ready-to-use client.

const result = await bootstrap({
  server: string,       // AuthProof server URL
  projectId?: string,   // target project (or discovers via well-known)
  inviteCode?: string,  // invite code (if using invite-based registration)
  name?: string,        // agent display name
  privateKey?: string,  // use existing key instead of generating
  chainId?: number      // default: 84532 (Base Sepolia)
});
// result: { client, privateKey, walletAddress, projectId, projectName }

createAutoPayment(privateKey, rpcUrl)

Creates a payment handler for automatic 402 handling. Sends ERC-20 USDC transfers on-chain.

signedFetch(url, init)

Drop-in replacement for fetch. Fetches /.well-known/erc8128 from the target origin (cached), generates a nonce, signs the request, and sends it.

signRequest(url, init)

Same as signedFetch but returns the signed Request without sending. Useful for capturing headers (e.g., demo panels).

MCP server

For MCP-compatible agents (Claude, Cursor, Windsurf), use @authproof/mcp-server instead — it wraps this SDK with MCP tools.

Links

• Docs
• GitHub
• MCP Server
• ERC-8128 Spec