tKey

tKey is the underlying SDK used to implement Web3Auth Plug n Play. This package can also be used to self host Web3Auth in your own system. tKey stands for Threshold Key, which refers to the management keys & shares generated using threshold cryptography.

v16 Breaking Change: All cryptographic primitives have been migrated from bn.js/elliptic/Buffer to native bigint/@noble/curves/Uint8Array. See the Migration Guide below.

The tKey SDK

The tKey SDK manages private keys by generating shares of it using Shamir Secret Sharing. For example, for a 2 out of 3 (2/3) setup, we give the user three shares: ShareA, ShareB, and ShareC.

• ShareA is stored on the user’s device: Implementation is device and system specific. For example, on mobile devices, the share could be stored in device storage secured via biometrics.
• ShareB is managed and split across Web3Auth's Auth Network, accessed by an OAuth login provider that a user owns.
• ShareC is a recovery share: An extra share to be kept by the user, possibly kept on a separate device, downloaded or based on user input with enough entropy (eg. password, security questions, hardware device etc.).

Similar to existing 2FA systems, a user needs to prove ownership of at least 2 out of 3 (2/3) shares, in order to retrieve his private key.

For more information, check out the technical overview. Before integrating you can also check out the example for tKey.

To use the SDK in your application, please refer to our SDK Reference in Web3Auth Documentation

Features

• Typescript compatible. Includes Type definitions
• Fully composable API
• Module support (Include only those modules which you require)
• Modern cryptography via @noble/curves (secp256k1, ed25519)
• Zero dependency on Buffer — uses native Uint8Array
• Audited

Packages

Packages	@latest Version	Size	Description
🐉 tKey Standard Package
@tkey/default			Bundles Core and Modules into one importable package
🏠 Core
@tkey/core			Core functionalities for creating a tkey
🐕‍🦺 Service Provider
@tkey/service-provider-torus			@service-provider-base with DirectAuth functionality
🗳 Storage Layer
@tkey/storage-layer-torus			get/set metadata for various shares
🔌 Modules
@tkey/chrome-storage			Add/remove a share from chrome extension storage
@tkey/web-storage			Add/remove a share from local and file storage
@tkey/security-questions			Add/remove a security question and password as a share for tkey
@tkey/share-transfer			Transfer share from another device
@tkey/seed-phrase			Store and use seedphrases on metadata
@tkey/private-keys			Store extra private keys on tKey metadata
@tkey/share-serialization			Import/export a share from tKey
🐉 Low-Level
@tkey/common-types			Shared TypeScript Types

Migration Guide

v16: bigint / @noble/curves / Uint8Array

v16 removes all legacy cryptography dependencies in favor of modern, audited alternatives:

Before	After
bn.js (BN)	Native bigint
elliptic	@noble/curves/secp256k1
@toruslabs/tweetnacl-js	@noble/curves/ed25519
Buffer	Uint8Array

What you need to change:

• Private keys and share values are now bigint instead of BN. Replace new BN(hex, 16) with BigInt(\0x${hex}`)`.
• Public keys and encrypted data are now Uint8Array instead of Buffer. Use hexToBytes / bytesToHex from @toruslabs/metadata-helpers for conversions.
• BNString type has been removed. APIs now use bigint directly (was BN | string).
• JSON serialization of objects containing bigint requires the bigIntReplacer from @tkey/common-types:

  import { bigIntReplacer } from "@tkey/common-types";
  JSON.stringify(thresholdKey, bigIntReplacer);

• @tkey/tss has been removed from this package and will be migrated separately.

Building the SDK Locally

Requirements

• This package requires a peer dependency of @babel/runtime
• Node 22+

Installation

npm install
npm run pack:lerna

Bundling

Each sub package is distributed in 3 formats

• esm build dist/<MODULE_NAME>.esm.js in es6 format
• commonjs build dist/<MODULE_NAME>.cjs.js in es5 format
• umd build dist/<MODULE_NAME>.umd.min.js in es5 format without polyfilling corejs minified

By default, the appropriate format is used for your specified usecase You can use a different format (if you know what you're doing) by referencing the correct file

The cjs build is not polyfilled with core-js. It is upto the user to polyfill based on the browserlist they target

Directly in Browser

CDN's serve the non-core-js polyfilled version by default. You can use a different

jsdeliver

<script src="https://cdn.jsdelivr.net/npm/<MODULE_NAME>"></script>

unpkg

<script src="https://unpkg.com/<MODULE_NAME>"></script>

Tips for NUXT

This is a plugin that works only on the client side. So please register it as a ssr-free plugin.