@theoo/sdk

The client for Theoo — smart accounts owned by a passkey that never leaves the user's device. No seed phrase, no extension, and no key on a server.

npm install @theoo/sdk

import { Theoo } from "@theoo/sdk";
import { browserPasskeys, LocalStorageTokenStore } from "@theoo/sdk/browser";

const theoo = new Theoo({
  baseUrl: "https://theoo.example.com",
  apiKey: "theoo_pub_…",              // publishable: safe in a page
  passkeys: browserPasskeys,
  tokens: new LocalStorageTokenStore(),
});

await theoo.auth.begin({ provider: "email", destination: "[email protected]" });
await theoo.auth.complete({ kind: "code", challengeId, code });
await theoo.auth.enrolPasskey();      // this passkey now owns the account

await theoo.me.operations.run({
  kind: "call",
  call: { to: "0x…", value: "0", data: "0x" },
});

Works in browsers and on servers. React bindings are in @theoo/react; native ones in @theoo/react-native.

Theoo is self-hosted: this package talks to a service you run. See the docs/ directory of the repository for running one, the HTTP API, and the full SDK reference.

Security

Which key goes where. A publishable key (theoo_pub_…) is meant to ship in a page: it reaches only the sign-in routes and the routes an end user's own bearer token already scopes to that user, and only from the origins its tenant registered. A secret key (theoo_…) can act for any of your users and must never reach a browser.

Where sessions are stored. LocalStorageTokenStore keeps the access and refresh tokens in localStorage, which any script running on your page can read. If your app has an XSS hole, that hole reaches the session.

It is worth being precise about what that does and does not mean. A stolen session can act as the user within what a session is allowed to do — read their account, start operations that then need a passkey. It cannot move funds or take the account: every operation is signed on the user's device by a passkey this package never sees and the server never holds. There is no seed phrase to steal and nothing to export.

Choose accordingly:

| Store | Use it when | | :--- | :--- | | LocalStorageTokenStore | The session should survive a reload. The usual choice. | | MemoryTokenStore | You would rather a reload sign the user out than leave a token readable by script. | | Your own TokenStore | You want the tokens somewhere else — a worker, an encrypted store, your own backend. |

Transport. Every request sends the API key and, when acting for a user, a bearer token. So the client:

• refuses a plaintext http:// base URL unless it is loopback. Pass allowInsecureHttp: true only for a server crossing a network you control.
• does not follow redirects (redirect: "error"). The API never issues one, and a redirect would hand x-api-key to whatever host it named.
• sends no cookies (credentials: "omit"), so nothing here is a CSRF target.
• logs nothing. There are no console calls in this package, so no token reaches a log by accident.

Dependencies. This package has none. @theoo/react depends only on this one. Nothing third-party enters your bundle through Theoo.