Ma'atara Developer Quickstart

PATENT PENDING — Ma'atara Protocol. Package versions checked against npm and local manifests on 21 September 2026.

Use the published SDKs for signing, verification and provenance integration. Native operations use ML-DSA-65, ML-KEM-768 and SHA3-384. Identity creation and recovery belong in the approved identity flow; a freshly generated demonstration key is not an enrolled account.

Packages and installation

npm install @maatara/pqc-toolkit@2.2.1 @maatara/veritas-chain@2.2.1
npm view @maatara/pqc-toolkit version
npm view @maatara/veritas-chain version

Both versions are published. Pin the versions you test and retain your lockfile. Publication does not activate a service or experimental messaging profile. See Packages for the published Aegis packages and licensing.

1. Initialize the toolkit

Browser example for Vite; run in client code:

import { createProtocolWasm } from '@maatara/pqc-toolkit';
import * as glue from '@maatara/pqc-toolkit/wasm/glue';
import wasmUrl from '@maatara/pqc-toolkit/wasm/binary?url';

const proto = createProtocolWasm();
await proto.init(wasmUrl, { glue });

Binary and glue must come from the same package release. For Workers and Node, use the runtime-specific guidance in Packages. Initialize once and await completion.

2. Sign and verify locally

This demonstration does not register an identity or send a private key:

const keypair = proto.pqc.keygen();
if ('error' in keypair) throw new Error(keypair.error);
const messageB64u = proto.hash.sha3StringB64u('hello world');
const signed = proto.pqc.sign(messageB64u, keypair.secret_b64u);
if ('error' in signed) throw new Error(signed.error);
const valid = proto.pqc.verify(messageB64u, signed.signature_b64u, keypair.public_b64u);
if (!valid) throw new Error('Signature verification failed');

Keep private material in approved endpoint custody. Do not log, upload or persist it in localStorage. Software/WASM custody does not establish hardware non-extractability.

3. Authenticate a request

Prefer your approved identity integration's assertion issuer. For an integration that owns an unlocked version-1 root session, this illustrates the public header contract. identity is supplied by that session with userId, publicKeyB64u and an in-memory secretB64u; it is not the demonstration keypair above or an npm export.

const b64u = value =>
  btoa(String.fromCharCode(...new TextEncoder().encode(value)))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');

function mintAuthHeader(audience) {
  const now = Date.now();
  const assertion = {
    version: 1,
    purpose: 'auth/session',
    userId: identity.userId,
    chainId: identity.publicKeyB64u,
    publicChainKey: identity.publicKeyB64u,
    issuedAt: now,
    expiresAt: now + 5 * 60 * 1000,
    nonce: crypto.randomUUID(),
    aud: audience,
  };
  const payload = b64u(JSON.stringify(assertion));
  const signature = proto.pqc.sign(payload, identity.secretB64u);
  if ('error' in signature) throw new Error(signature.error);
  return `MaataraAssertion ${payload}.${signature.signature_b64u}`;
}

purpose: 'auth/session', a fresh nonce and the exact route audience are required. Every assertion is single-use, including reads and retries. Do not cache authorization headers. Use the audience table for the destination. Device sessions use the separately validated version-2 contract; do not substitute a device key into this root-session example.

4. Discover services

curl https://api.ma-atara.io/health
curl https://api.ma-atara.io/api/capabilities
curl https://api.ma-atara.io/api/version
curl https://api.ma-atara.io/openapi.json

Health proves liveness only. Check the service identity, build and required capabilities. Browser calls also need an allowed origin; successful curl is not a CORS test.

5. Integrate records and anchors

Use Veritas record integration for SDK validation and Anchors for preparing submissions. Current Core code includes native v4 reads and appends; older v3-only descriptions are obsolete. Preserve the profile returned by the endpoint, and never relabel or hand-convert a stored record.

An anchor receipt is not proof of public-ledger inclusion. Experimental pairwise and hybrid channels remain production-disabled; private orchestration is not installable from npm. Temporary legacy account healing is retired (HTTP 410).

Next

• Authentication
• Core API
• Testing
• AI consent

There is no supported one-click third-party Worker template. Repository deployment scripts target the reviewed Ma'atara account and are not a third-party hosting workflow.