> For the complete documentation index, see [llms.txt](/llms.txt)

# Seal SDK

Decentralized secrets management with threshold encryption on Sui.



<Callout type="info">
  This is a beta version of Seal. See [https://github.com/MystenLabs/seal](https://github.com/MystenLabs/seal) for more details.
</Callout>

The Seal SDK provides threshold encryption capabilities for Sui applications, enabling secure data
encryption with configurable key servers.

## Installation [#installation]

```bash npm2yarn
npm install --save @mysten/seal @mysten/sui
```

## Setup [#setup]

To use the Seal SDK, create a Sui client and extend it with the Seal extension:

```ts
import { SuiGrpcClient } from '@mysten/sui/grpc';
import { seal } from '@mysten/seal';

const client = new SuiGrpcClient({
	network: 'testnet',
	baseUrl: 'https://fullnode.testnet.sui.io:443',
}).$extend(
	seal({
		serverConfigs: [
			{ objectId: '0x...keyserver1', weight: 1 },
			{ objectId: '0x...keyserver2', weight: 1 },
		],
	}),
);
```

## Configuration options [#configuration-options]

The `seal()` function accepts the following options:

* **`serverConfigs`** (required) - Array of key server configurations (see
  [Choosing key servers](#choosing-key-servers)). Each entry contains:
  * **`objectId`** (required) - The key server object ID
  * **`weight`** (required) - How many times the key server can contribute towards reaching the
    decryption threshold
  * **`aggregatorUrl`** (required for decentralized servers) - The aggregator endpoint URL
  * **`apiKeyName`*&#x2A; and &#x2A;*`apiKey`** (optional) - Required if the server requires API key
    authentication
* **`verifyKeyServers`** (optional) - Whether to verify key server authenticity (default: `true`)
* **`timeout`** (optional) - Timeout in milliseconds for network requests (default: `10000`)
* **`fetch`** (optional) - Custom fetch implementation used for all key server requests (default:
  the global `fetch`), for example to send cookies with `credentials: 'include'` or attach your own
  headers

## Choosing key servers [#choosing-key-servers]

Seal supports two server types, **independent** and **decentralized** (committee mode), which you
can use individually or in combination. Each key server counts as one server in your threshold
configuration. Decentralized servers require an `aggregatorUrl`, because all fetch key calls go
through an aggregator:

```ts
const client = new SuiGrpcClient({
	network: 'testnet',
	baseUrl: 'https://fullnode.testnet.sui.io:443',
}).$extend(
	seal({
		serverConfigs: [
			// Decentralized (committee mode) server
			{
				objectId: '0xb012378c9f3799fb5b1a7083da74a4069e3c3f1c93de0b27212a5799ce1e1e98',
				aggregatorUrl: 'https://seal-aggregator-testnet.mystenlabs.com',
				weight: 1,
			},
			// Independent server
			{
				objectId: '0x73d05d62c18d9374e3ea529e8e0ed6161da1a141a94d3f76ae3fe4e99356db75',
				weight: 1,
			},
		],
	}),
);
```

If a server requires API key authentication, include `apiKeyName` and `apiKey` in its configuration
object. The SDK sends these as an HTTP header in the format `apiKeyName: apiKey`.

For more details on server types, verified key servers, and API key authentication, see
[Using Seal](https://seal-docs.wal.app/UsingSeal) in the main Seal documentation.

## Basic usage [#basic-usage]

### Encrypting data [#encrypting-data]

```ts
const data = new Uint8Array([1, 2, 3]);

const { encryptedObject } = await client.seal.encrypt({
	threshold: 2, // Number of key servers needed to decrypt
	packageId: '0x...your-package-id',
	id: '0x...your-object-id',
	data,
});
```

### Decrypting data [#decrypting-data]

```ts
import { SessionKey } from '@mysten/seal';

// Create a session key for decryption
const sessionKey = await SessionKey.create({
	address: senderAddress,
	packageId: '0x...your-package-id',
	ttlMin: 10, // Time-to-live in minutes
	signer: keypair,
	suiClient: client,
});

// Build transaction bytes that call seal_approve
const txBytes = await buildApprovalTransaction(/* ... */);

// Decrypt the data
const decryptedData = await client.seal.decrypt({
	data: encryptedObject,
	sessionKey,
	txBytes,
});
```

## Resources [#resources]

For detailed documentation on threshold encryption and key server setup, see the
[Seal repository](https://github.com/MystenLabs/seal).