Build on Sigcore.

Open Authentication → Integration for the hosted SDK example, backend routes, saved branding and deployment prerequisites.

1. Step 1

   Install the SDK

   Browser-only, zero runtime dependencies, ES2022 modules.

   terminalCopy

   npm install @sigcore/sdk@2.5.1
   

2. Step 2

   Load it with your publishable key

   Publishable keys are safe to ship to the browser. On their own they grant no API access.

   sigcore.tsCopy

   import { loadSigcore, type OrgId, type HexString } from "@sigcore/sdk";
   
   // Run in the browser, for example in a Next.js client component.
   const key = process.env.NEXT_PUBLIC_SIGCORE_PUBLISHABLE_KEY;
   const organizationId = process.env.NEXT_PUBLIC_AUTH_ORG_ID;
   if (!key || !organizationId) throw new Error("Missing integration configuration");
   const orgId = organizationId as OrgId;
   const sigcore = await loadSigcore(key);
   

3. Step 3

   Legacy: create a sealed session from your backend

   For integrations with an existing verified Auth login, your organisation's confidential backend/BFF creates a user-bound wallet session sealed to the SDK receiver key. New hosted integrations should use Authentication → Integration instead.

   session.tsCopy

   const receiverKey = sigcore.client.getIframeReceiverKey();
   if (!receiverKey) throw new Error("This bridge cannot receive sealed sessions");
   
   // Implement this route on your organisation's confidential backend/BFF with CSRF protection.
   // Verify your application's live user session, obtain fresh Auth proof,
   // and seal a user-bound Sigcore client secret to receiverKey.
   // Never trust browser-supplied user or organisation identity.
   const response = await fetch("/api/sigcore/session", {
     method: "POST",
     headers: { "content-type": "application/json" },
     credentials: "same-origin",
     body: JSON.stringify({ receiverKey }),
   });
   if (!response.ok) throw new Error("Could not create a Sigcore session");
   const { envelope } = await response.json();
   await sigcore.client.setClientSession(envelope);
   

4. Step 4

   Create a wallet and sign

   Keys are generated inside the enclave. Your code only ever sees the public key, the policy ruling and the signature. If a rule requires approval, the intent comes back as pending instead of signed.

   wallet.tsCopy

   const { wallet } = await sigcore.client.createWallet({
     orgId,
     name: 'Treasury',
     algorithm: 'ED25519', // or 'SECP256K1_ECDSA'
   })
   
   const { intent, policyRuling } = await sigcore.client.signMessage({
     orgId,
     walletId: wallet.id,
     messageHex: 'deadbeef' as HexString,
   })
   
   // decision: ALLOW, REQUIRE_APPROVAL,
   // REQUIRE_DELAY or DENY
   policyRuling.decision
   intent.signatureHex  // set when ALLOW
   

import { createTrustCoreAuth } from "@trustcore/auth";

// Confirmed target: https://auth.sigcore.io; initial RP ID: auth.sigcore.io.
// This discovery factory reads policy; hosted flows use createHostedAuthClient.
const authOrigin = process.env.NEXT_PUBLIC_AUTH_API_URL;
const organizationId = process.env.NEXT_PUBLIC_AUTH_ORG_ID;
const applicationId = process.env.NEXT_PUBLIC_AUTH_APP_ID;
if (!authOrigin || !organizationId || !applicationId) {
  throw new Error("Missing TrustCore Auth configuration");
}

const auth = createTrustCoreAuth({ authOrigin, organizationId, applicationId });
const { descriptors } = await auth.getAvailableMethods();
// Use the returned labels and enabled methods in your sign-in UI.
// Discovery is public policy data; it does not establish a login session.
console.log(descriptors);

// These flags describe this discovery factory, not the hosted BFF transport.
auth.capabilities; // methodDiscovery: true; hostedLogin/session/logout: false

What the API covers