@kairosauth/sdk

Device-first, blockchain-anchored authentication SDK. Zero runtime dependencies.

Features

• P-256 (secp256r1) key generation via SubtleCrypto
• WebAuthn PRF for hardware-backed key wrapping (Secure Enclave)
• HKDF / Argon2id key derivation
• IndexedDB encrypted key storage
• On-chain Merkle proof verification
• ERC-4337 smart wallet integration
• Offline-first with network failover

Install

npm install @kairosauth/sdk

Quick Start

import { KairosAuthClient } from "@kairosauth/sdk";

const client = new KairosAuthClient({
  projectId: "ka_proj_abc123",
  apiKey: "ka_test_xxx",
});

// Register / Login
const flow = await client.register("[email protected]");
const result = await flow.submitOTP("ABC12345");
console.log("Identity:", result.identityId);

Security Tiers

| Tier | Storage | Key Protection | |------|---------|----------------| | 1 | Secure Enclave | WebAuthn PRF + HKDF (non-extractable) | | 2 | IndexedDB | Argon2id password wrapping |

API

Client

• KairosAuthClient - Main orchestrator (register, login, wallet)

Crypto

• generateKeyPair() - P-256 ECDSA key generation
• wrapKey() / unwrapKey() - AES-GCM key wrapping
• signChallenge() - ECDSA signature
• deriveWrappingKey() - HKDF from device secret

WebAuthn

• createCredential() - Register a passkey with PRF
• getAssertion() - Authenticate with passkey
• detectTier() - Check device capabilities

Storage

• storeWrappedKey() / getWrappedKey() - IndexedDB operations
• hasStoredIdentity() - Check for existing credentials

License

MIT