Overview

Each Revibase accessory has a passkey tied to an on-chain token. A tap proves the holder is present — you decide what that unlocks.

Install

pnpm add phygital-token-sdk @solana/kit

Authenticate

Issue a message (e.g. randomUUID())
startAuthentication(message) — user taps the accessory
verifyResponse({ expectedMessage, response }) → { isVerified, secp256r1PublicKey }
Your logic

import { randomUUID } from "crypto";
import { startAuthentication, verifyResponse } from "phygital-token-sdk";

const message = randomUUID();
const response = await startAuthentication(message);

const { isVerified, secp256r1PublicKey } = verifyResponse({
  expectedMessage: message,
  response,
});

if (!isVerified) throw new Error("Access denied");

For kiosk or native apps, pass a custom transceive function as the second argument to startAuthentication.

Gate access

After verification, apply your rules to secp256r1PublicKey:

Pattern	When to use
On-chain ownership lookup	Fetch the token after the tap and gate on `owner` (the linked wallet). Optionally also gate on `mint` when it is set. Simple to ship; one RPC per check-in.
Pre-synced whitelist	Sync eligible passkeys on a schedule, then check membership at tap time with no RPC. Best for high-throughput check-in.

You can also gate against your own off-chain data (membership lists, allowlists, etc.) using secp256r1PublicKey directly.