@piper-partner/create

Create Token SDK for Piper Partner API. Non-custodial for on-chain create (unsigned guidance only).

Security: wallet ↔ partner key binding

Sensitive actions (upload, register, requestRotation) require:

1. Partner key with scope tokens:create (or rotation endpoints)
2. EIP-191 signature from the same wallet that requested the key (applicantWallet)

A stolen piper_… key alone is rejected (WALLET_BINDING_REQUIRED / WALLET_KEY_MISMATCH).

Agent host env

PIPER_PARTNER_KEY=piper_…
PIPER_BOUND_WALLET_PRIVATE_KEY=0x…   # wallet that requested the key — host only, never in browsers
PIPER_API_BASE=https://api.testsback.com/api/v1/partner

import { PiperCreateClient, boundWalletFromEnv } from "@piper-partner/create";

const boundWallet = await boundWalletFromEnv();
const create = new PiperCreateClient({
  apiKey: process.env.PIPER_PARTNER_KEY!,
  boundWallet,
});

await create.uploadImageSigned({ chainId: 9009, imageBase64: "…" });
await create.requestRotation({ kind: "api_key", reason: "key leaked in CI log" });

Server Content Safety still applies to all images/text/links.