Developer SDKs

Two SDKs.
One platform.

@zafeguard/caller-sdk triggers workflows and components on the platform. @zafeguard/mpc-sdk lets your app hold an MPC share and participate in threshold ceremonies itself. Use them independently or together.

Install whichever you need

Caller SDKTrigger workflows & components
npm install @zafeguard/caller-sdk
MPC SDKHold an MPC share client-side
npm install @zafeguard/mpc-sdk

Works with pnpm and yarn too. The MPC SDK ships native binaries for every major Node.js platform plus a WebAssembly fallback that runs in browsers, Expo, and Workers.

@zafeguard/caller-sdk

Execute components.
Trigger workflows.

  • Typed ComponentModule enum
    Every component has a typed input + output schema. Pass the enum value, get back the exact result shape — no manual casts.
  • .promise() — wait for result
    Opens an SSE stream to the platform and resolves with the typed result on completion. No polling.
  • .execute() — fire and track
    Returns immediately with an execution record. Pair with a callbackUrl for webhook delivery, or poll/stream the status separately.
  • WorkflowClient
    Trigger a configured workflow, wait for the run, or stream stage-by-stage progress in real time.
  • Synchronous input validation
    Inputs are validated against the component's Zod schema before any network call. Throws synchronously — no await needed to catch.
  • Signed callback verification
    Component executions can deliver results to your endpoint with an HMAC-signed callback header — confirm authenticity in one line.
Full Caller SDK reference
workspace.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
import { WorkspaceClient, ComponentModule } from '@zafeguard/caller-sdk'

const workspace = new WorkspaceClient({ 
  apiKey:    process.env.ZAFEGUARD_API_KEY!,
  apiSecret: process.env.ZAFEGUARD_API_SECRET!,
})

// Typed input → typed output, no polling
const { balance } = await workspace
  .call(ComponentModule.GET_EVM_ACCOUNT_BALANCE, {
    jsonRpcUrl:   'https://eth-mainnet.g.alchemy.com/v2/KEY',
    tokenAddress: '0x0000000000000000000000000000000000000000',
    account:      '0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045',
  })
  .promise()

console.log(balance)  // "1000000000000000000"
@zafeguard/mpc-sdk

Hold an MPC share.
Sign without exposing keys.

  • EmbeddedSigner
    High-level facade for the warm-cold wallet shape — one device share, N cloud-agent shares, threshold signing across the cohort. Five methods cover the whole lifecycle.
  • MPCAgent
    Lower-level surface — direct cluster client for institutional setups that want server-side custody with no embedded device party.
  • Presignature pool
    Mint signatures in batches so the device can keep signing offline between agent round-trips. Manual or auto-refill.
  • Pluggable storage
    In-memory, file, or hardware-wrapped adapters. Pair with iOS Secure Enclave or Android Keystore to seal the device share.
  • Recovery + reshare
    Sealed recovery bundles, cloud-agent reshare, sign-pack export for cold-storage flows. Root public key is preserved end-to-end.
  • Universal runtime
    Native binaries on Node.js (macOS + Linux glibc + Linux musl); WASM on browsers, Expo, Cloudflare Workers, Deno, Bun. Same API across all four.
Full MPC SDK reference
signer.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
import { EmbeddedSigner, Curve, RecoveryKind } from '@zafeguard/mpc-sdk'

const signer = new EmbeddedSigner({
  agent:     [{ baseUrl: 'https://node-1.example', apiKey: '...' }],
  threshold: 2,
  curve:     Curve.Secp256k1,
})

// Generate the wallet — device holds share[0], agent holds share[1]
const loaded = await signer.create({ signerId, recovery: { kind: RecoveryKind.Noop } })

// Sign — combines device + threshold-many agent partials offline
const sig = await loaded.sign({ messageHash })

Direct REST API too

Skip the SDK and hit the API directly. Every request needs three headers — API key, timestamp, and an Ed25519 signature — so even compromised network paths can't replay or tamper.

The TypeScript SDKs handle signing for you; this is what they call under the hood.

POST/v1/sdk/components
GET/v1/sdk/components/executions/{executionId}
SSE/v1/sdk/components/executions/{executionId}/stream
POST/v1/sdk/workflows/{workflowId}
GET/v1/sdk/workflows/executions/{runId}
SSE/v1/sdk/workflows/executions/{runId}/stream
Full REST API reference