# AffixIO in the browser and WASM

Canonical page: https://www.affix-io.com/sdk-web/
Node SDKs: https://www.affix-io.com/sdk/ and https://www.affix-io.com/sdk-light/
API base: https://api.affix-io.com
Connection surfaces index: https://www.affix-io.com/connections/
Site brief: https://www.affix-io.com/llms.txt

## Packaging statement

There is a browser and edge package. There is no published WASM build.

- `@affix-io/sdk` 1.1.1: Node.js 18+, UltraHonk zero-knowledge prove.
- `@affix-io/sdk-light` 1.1.3: Node.js 18+, HMAC-SHA256 Light prove and `verifyLocal`.
- Both of the above are Node ESM packages with `engines.node >= 18` and no browser export field.
- `@affix-io/sdk-web` 0.1.0: browser and edge client, Web Crypto and Fetch only, no Node APIs, no Noir, no bb.js, no QR libraries. Exports `AffixLightWeb` (local Light prove and verify), `AffixWebClient` (REST), `verifyWebhookSignature`, and presentment token pack and unpack. Runs in modern browsers, Cloudflare Workers, Deno and any Fetch plus SubtleCrypto runtime.
- `@affix-io/sdk-web` is NOT published on npm. It is distributed as source by AffixIO; on the AffixIO host the tree is at `/var/www/vhosts/api.affix-io.com/packages/sdk-web/`. Contact hello@affix-io.com for a copy.
- No WASM build exists for either proving path.

Security constraint that does not change: whoever holds the Light shared secret can mint Light proofs. Keep it out of untrusted browser code. `AffixLightWeb` is intended for edge runtimes and trusted contexts, not for a public web page.

## Light is not ZK

Light proofs are HMAC-SHA256 state proofs. They give integrity and authenticity under a shared secret. They are not SNARKs and not zero knowledge. The UltraHonk path in `@affix-io/sdk` is the zero-knowledge path. Both paths sync outcomes that AffixIO signs with ML-DSA-65.

## Recommended browser pattern

1. Browser captures a carrier (camera or paste).
2. Operator authenticates to your own origin with a short-lived session.
3. Your backend calls `POST /v1/verify` or `POST /v1/gate/verify` with the AffixIO API key.
4. Browser receives a boolean, a reason code and `X-Request-Id`. Never the key.
5. Optionally reconcile later via https://www.affix-io.com/webhooks/ or https://www.affix-io.com/siem/.

An AffixIO API key in client JavaScript is a key anyone can copy from DevTools. Do not do that. CORS on credentialed requests is restricted to known AffixIO origins.

## What a browser can do without a key

- `GET /v1/merkle/root` - public Merkle root.
- `GET /.well-known/affix-mldsa65.json` - ML-DSA-65 public key, cacheable for one hour.
- Scan a carrier with any QR or barcode library, then send the string to your backend.
- Fold a Merkle inclusion proof with Web Crypto once the proof arrives through your backend. Domain-separated SHA-256: `sha256(b"affix:node:" + lo + hi)` with the two hex hashes sorted.

## On WASM

- Zero-knowledge proving in the browser: not supported. UltraHonk through Barretenberg is large in its current packaging and stays on Node.
- Light proving at the edge: supported through `@affix-io/sdk-web` on Web Crypto, no WASM needed. Light proofs are not zero knowledge.
- Verifying Merkle inclusion: already possible with Web Crypto.
- Verifying ML-DSA-65 in the browser: AffixIO does not currently ship a WASM implementation. Verify signatures on a host you control.
- If a WASM prover becomes something AffixIO is prepared to support, it will be announced as a versioned package.

Last updated: 2026-08-14