Authentication

Every protected Droplit route uses BRC-103/104 mutual authentication. The client and server prove their identities through an SDK-managed handshake.

Preferred browser model: Sigma

For Droplit UI and app integrations using Sigma:

1. User authenticates with Sigma.
2. The connected Sigma iframe exposes the SDK WalletInterface.
3. Your app gives that wallet to AuthFetch for HTTP or Peer for WebSockets.

Keys remain inside the Sigma domain while the SDK performs mutual authentication.

Service-to-service example

import { AuthFetch, PrivateKey, ProtoWallet } from "@bsv/sdk";

const wallet = new ProtoWallet(
	PrivateKey.fromWif(process.env.DROPLIT_SIGNER_WIF),
);
const client = new AuthFetch(wallet);

Security checklist

• Prefer Sigma-hosted wallets for browser flows.
• Never expose private keys in frontend bundles.
• Keep backend wallet keys in a secrets manager.
• Use separate keys for dev, staging, and prod.
• Scope public keys per droplit allowlist.
• Let the SDK own all handshake and session protocol work.

Related references

• API Authentication
• Permission Model
• Agent Playbooks