TypeScript SDK

The @specterpq/sdk package gives you the full SPECTER protocol in TypeScript. Key generation, encapsulation, scanning, and stealth address derivation all run on the device through Rust compiled to WebAssembly. Nothing secret leaves the machine unless you explicitly ask it to.

If you have used the hosted API, this is the other way in. The API is a service you call. The SDK is a library you embed, and it does the cryptography itself.

Install and run the flow

Send and recover a stealth payment end to end in a few minutes of TypeScript.

API reference

Every exported function, with sizes, return shapes, and error codes.

Integration patterns

Receive profiles, payment composers, and scanners for real apps.

Security model

What stays local, what secret-bearing fields look like, and when network calls happen.

What the SDK does

It packages the same protocol the rest of these docs describe, exposed as plain functions:

• Generate ML-KEM-768 spending and viewing keypairs.
• Build and parse a recipient meta-address.
• Encapsulate to a viewing key and derive a one-time stealth address on Ethereum and Sui.
• Compute and check the one-byte view tag that makes scanning cheap.
• Decapsulate a match and recover the spendable private key.

The three phases below are the whole story. Switch between them to see who acts and what moves on each step.

You generate two ML-KEM-768 keypairs and publish one meta-address. That is the only address you ever share.

• Spending key controls funds
• Viewing key detects payments
• Meta-address is public and reusable

Where the cryptography runs

The SDK ships two WebAssembly builds, one for browsers and one for Node, and loads the right one at runtime. The crypto is compiled from pinned Rust crates, so the same primitives back the SDK, the CLI, and the hosted backend.

The SPECTER Rust core compiled to WebAssembly is what the SDK calls for every cryptographic step.

Calls that handle secrets stay offline. The only code that touches the network is the trusted API client, and you have to construct it on purpose.

SDK or hosted API

Both reach the same protocol. They differ in where keys live and who you trust.

	TypeScript SDK	Hosted API
Cryptography runs	On the user's device (WASM)	On the SPECTER backend
Secret keys are seen by	Only the local app	The backend, for remote helpers
Network calls	None, unless you opt in	Every request
Best for	Wallets and apps that keep keys client side	Quick prototypes, server orchestration
Language	TypeScript / JavaScript	Any HTTP client

Note

Mixing is fine. A common shape is local key generation and scanning with the SDK, and a trusted API only for tasks you choose to delegate. See integration patterns.

Requirements

• Node.js 20 or newer for server-side use and tests.
• A browser with WebAssembly support for frontend use.

Next steps

• New to the protocol? Read How SPECTER works first, then come back.
• Ready to write code? Go to the SDK quickstart.
• Reviewing trust assumptions? Read the security model and security boundaries.