@quantpass/sdk

TypeScript SDK for QuantPass — post-quantum credential management.

Installation

npm install @quantpass/sdk
# or
pnpm add @quantpass/sdk

Quick start

import { QuantPassClient } from '@quantpass/sdk';

const qp = new QuantPassClient({
  apiUrl: 'https://7qnrr6u7pd.execute-api.us-east-2.amazonaws.com',
});

Authentication

QuantPass uses Dilithium2 (ML-DSA-44) zero-knowledge authentication. No password is ever transmitted — only a cryptographic proof.

Register a keypair

import { initPQC, Dilithium } from '@quantpass/pqc-core';
import fs from 'fs';

// Load WASM runtime
await initPQC(fs.readFileSync('./liboqs.wasm').buffer as ArrayBuffer);

const dilithium = new Dilithium('Dilithium2');
const { publicKey, privateKey } = await dilithium.generateKeypair();

// Store privateKey securely — never transmit it
const publicKeyB64 = btoa(String.fromCharCode(...publicKey));

await qp.auth.register({
  userId:    '[email protected]',
  domain:    'github.com',
  publicKey: publicKeyB64,
});

Authenticate

const auth = await qp.auth.authenticate({
  userId: '[email protected]',
  sign: async (nonce) => {
    const nonceBytes = new TextEncoder().encode(nonce);
    const sigBytes   = await dilithium.sign(nonceBytes, privateKey);
    return btoa(String.fromCharCode(...sigBytes));
  },
});

// auth.verifiedToken — use within 2 minutes for vault retrieve
// auth.publicKeyFingerprint — for key derivation

Vault

Store a credential

await qp.vault.store({
  userId:               '[email protected]',
  domain:               'github.com',
  password:             'my-secret-password',
  publicKeyFingerprint: auth.publicKeyFingerprint,
});

Retrieve a credential

const { password } = await qp.vault.retrieve({
  userId:               '[email protected]',
  domain:               'github.com',
  verifiedToken:        auth.verifiedToken,
  publicKeyFingerprint: auth.publicKeyFingerprint,
});

One-call convenience method

// Authenticate + retrieve in a single call
const password = await qp.getSecret({
  userId:     'github-actions',
  domain:     'prod.example.com',
  privateKey,
  dilithium,
});

Machine credentials (M2M)

List credentials

const qp = new QuantPassClient({
  apiUrl:      'https://7qnrr6u7pd.execute-api.us-east-2.amazonaws.com',
  adminApiUrl: 'https://tpd2wuqmsp.us-east-2.awsapprunner.com',
  sessionToken: cognitoToken,
});

const creds = await qp.credentials.list();
// Filter by service
const k8sCreds = await qp.credentials.list({ serviceId: 'kubernetes-prod' });
// Get expiring soon
const urgent = await qp.credentials.getExpiring(14); // expiring within 14 days

Create a credential

const cred = await qp.credentials.create({
  serviceId:        'github-actions',
  serviceName:      'GitHub Actions',
  secretType:       'API_KEY',
  secretName:       'PROD_DEPLOY_KEY',
  rotationSchedule: '30d',
  validityDays:     30,
});

Rotate a credential

await qp.credentials.rotate({
  serviceId:    'github-actions',
  credentialId: cred.credentialId,
  validityDays: 90,
});

Delete a credential

await qp.credentials.delete('github-actions', cred.credentialId);

PQC Certificates

const cert = await qp.auth.certify({
  userId:            '[email protected]',
  tenantId:          '[email protected]',
  kyberPublicKeyB64: kyberPublicKey,
});

// cert.certificateArn  — AWS ACM-PCA ARN
// cert.certificatePem  — PEM-encoded certificate
// cert.issuedAt        — ISO timestamp

CI/CD integration

GitHub Actions

- name: Get production secret
  run: |
    SECRET=$(node -e "
      const { QuantPassClient } = require('@quantpass/sdk');
      const qp = new QuantPassClient({ apiUrl: process.env.QP_API_URL });
      qp.getSecret({
        userId:     process.env.QP_SERVICE_ID,
        domain:     'prod.example.com',
        privateKey: Buffer.from(process.env.QP_PRIVATE_KEY, 'base64'),
        dilithium,
      }).then(console.log);
    ")
    echo "SECRET=$SECRET" >> $GITHUB_ENV

Kubernetes (init container)

// k8s-init.ts — run as init container to populate secrets
const qp = new QuantPassClient({ apiUrl: process.env.QP_API_URL! });

const dbPassword = await qp.getSecret({
  userId:     process.env.QP_SERVICE_ID!,
  domain:     'database.internal',
  privateKey: Buffer.from(process.env.QP_PRIVATE_KEY!, 'base64'),
  dilithium,
});

// Write to /vault/secrets/db-password
fs.writeFileSync('/vault/secrets/db-password', dbPassword ?? '');

Error handling

import { QuantPassClient, QuantPassError } from '@quantpass/sdk';

try {
  const auth = await qp.auth.authenticate({ userId, sign });
} catch (err) {
  if (err instanceof QuantPassError) {
    console.error(`Auth failed: ${err.message} (${err.statusCode})`);
    if (err.code === 'TIMEOUT') {
      // retry logic
    }
  }
}

API reference

QuantPassClient

| Method | Description | |---|---| | auth.register(options) | Register a Dilithium2 public key | | auth.challenge(userId) | Fetch a challenge nonce | | auth.verify(options) | Verify a signature and get a verifiedToken | | auth.authenticate(options) | Full ZK auth flow (challenge + sign + verify) | | auth.certify(options) | Issue a PQC certificate via AWS Private CA | | vault.store(options) | Store an encrypted credential | | vault.retrieve(options) | Retrieve a credential (requires verifiedToken) | | credentials.list(filter?) | List machine credentials | | credentials.create(options) | Create a machine credential | | credentials.rotate(options) | Rotate a credential (extend expiry) | | credentials.delete(serviceId, credentialId) | Delete a machine credential | | credentials.getExpiring(days?) | Get credentials expiring within N days | | getSecret(options) | Authenticate + retrieve in one call |

Cryptographic specifications

| Algorithm | Standard | Usage | |---|---|---| | ML-DSA-44 (Dilithium2) | NIST FIPS 204 | Authentication signatures | | ML-KEM-1024 (Kyber) | NIST FIPS 203 | Vault encryption at rest | | SHA-256 | FIPS 180-4 | Public key fingerprinting |

License

UNLICENSED — QuantPass proprietary. All rights reserved.