Authentication
BRC-103/104 mutual authentication for the Droplit API.
Authentication
Every protected Droplit route uses BRC-103/104 mutual authentication. The client
and server prove their identities through the SDK handshake. AuthFetch takes a
WalletInterface. There is no bearer token or API-key header to construct.
ProtoWallet is one adapter from a WIF. The dashboard uses the Sigma iframe
WalletInterface, not ProtoWallet.
HTTP requests
Use one long-lived AuthFetch instance so authenticated sessions can be reused.
Service agents connect an existing signer using HTTPWalletJSON. Example,
only if the wallet already exposes SDK signer RPC at that address:
import { AuthFetch, HTTPWalletJSON } from "@bsv/sdk";
const wallet = new HTTPWalletJSON("droplit-cli.local", "http://127.0.0.1:3321");
const client = new AuthFetch(wallet);
const response = await client.fetch("https://api.droplit.dev/faucet/my-droplit/access", { method: "GET" });CLI: droplit access --name my-droplit --wallet-url http://127.0.0.1:3321 --json.
Use the CLI for a read-only access check: it also refuses SDK automatic payments
on a 402 response. --wif remains supported without environment-key fallback.
1sat serve wallet exposes storage RPC and cannot be used as this signer.
If DROPLIT_API_URL is set, use that value as-is. If it is unset, use
https://api.droplit.dev.
Browser requests with Sigma
The dashboard passes the connected Sigma iframe WalletInterface to
AuthFetch or Peer. Keys remain in the Sigma domain; the iframe wallet
performs the SDK operations on request.
Sigma OAuth can return bap_id, pubkey, and a bearer. That token is not a
WalletInterface and does not complete Droplit AuthFetch. Live RFC 8414 at
https://auth.sigmaidentity.com/.well-known/oauth-authorization-server
does not advertise a device grant.
WebSocket activity stream
The activity stream uses the same BRC-103/104 protocol through the SDK's Peer
class and a WebSocket Transport. See the stream guide for the complete
connection pattern.
Security notes
- Never commit WIFs or secrets.
- Keep one wallet identity per environment and runtime boundary.
- Reuse authenticated clients instead of rebuilding a handshake for each call.
- Never reimplement the SDK's nonce, signature, certificate, or session logic.