@sneekin/sdk 1.1.0 → 1.1.1

package/dist/core/derive-keys.d.ts

@@ -1,3 +1,4 @@
+export declare function isValidApiKey(apiKey: string): boolean;
 export interface DerivedKeys {
     qrSigningKey: Buffer;
     webhookSigningKey: Buffer;

package/dist/core/generated/api.d.ts

@@ -34,6 +34,56 @@ export type HealthResponse = {
     timestamp: string;
     service: string;
 };
+export type OpenapiDocumentResponse = {
+    [key: string]: unknown;
+};
+export type WebsiteSessionResponse = {
+    authenticated: true;
+    user: {
+        sub: string;
+        email: string;
+        displayName: string;
+        platformRole: 'owner' | 'admin' | 'developer' | 'viewer';
+        activeOrgId: string | null;
+        orgRoles: Array<{
+            orgId: string;
+            role: 'owner' | 'admin' | 'developer' | 'viewer';
+        }>;
+    };
+} | {
+    authenticated: false;
+    user: null;
+};
+export type SneekVerifyAction = {
+    action: 'config';
+} | {
+    action: 'request';
+    identifier: string;
+} | {
+    action: 'switch';
+    requestId: string;
+    channel: 'sms' | 'whatsapp' | 'email' | 'push';
+    proof: string;
+} | {
+    action: 'verify';
+    requestId: string;
+    code?: string;
+    proof: string;
+} | {
+    action: 'verify';
+    requestId: string;
+    ref: string;
+    bindingProof: string;
+} | {
+    action: 'create';
+} | {
+    action: 'status';
+    ref: string;
+    bindingProof: string;
+};
+export type SneekVerifyResponse = {
+    [key: string]: unknown;
+};
 export type CreateApplication = {
     websiteUrl: string;
     displayName?: string;
@@ -53,7 +103,6 @@ export type UpdateApplication = {
 };
 export type CreateApiKey = {
     name?: string;
-    environment?: 'live' | 'test';
     expiresAt?: string;
 };
 export type ListApplicationsResponse = {
@@ -129,7 +178,6 @@ export type ListApiKeysResponse = {
         applicationId: string;
         name: string;
         prefix: string;
-        environment: 'live' | 'test';
         lastUsedAt: string | null;
         expiresAt: string | null;
         revokedAt: string | null;
@@ -141,7 +189,6 @@ export type CreateApiKeyResponse = {
     applicationId: string;
     name: string;
     prefix: string;
-    environment: 'live' | 'test';
     lastUsedAt: string | null;
     expiresAt: string | null;
     revokedAt: string | null;
@@ -149,16 +196,12 @@ export type CreateApiKeyResponse = {
     key: string;
 };
 export type QrSignInSettings = {
-    secretCreatedAt: string | null;
     webhookUrl: string | null;
     defaultWebhookPath: string;
 };
 export type UpdateQrWebhook = {
     webhookUrl: string | null;
 };
-export type CreateQrSigningSecretResponse = QrSignInSettings & {
-    secret: string;
-};
 export type CreateOrder = {
     amount: string;
     currency?: 'INR';
@@ -370,9 +413,6 @@ export type ListAuditLogResponse = {
         organizationSlug: string | null;
     }>;
 };
-export type GetOpenapiDocumentResponse = {
-    [key: string]: unknown;
-};
 export type OrganizationDetailResponse = {
     organization: {
         id: string;
@@ -422,6 +462,11 @@ export type OrganizationDetailResponse = {
     analytics: {
         currency: 'INR';
         authUsers: number;
+        uniqueUsers: {
+            accounts: number;
+            emailOnly: number;
+            mobileOnly: number;
+        };
         monthToDateChargeMicroInr: number;
         allTimeChargeMicroInr: number;
         monthToDateUsage: {
@@ -469,6 +514,11 @@ export type OrganizationDetailResponse = {
     applicationAnalytics: Array<{
         applicationId: string;
         authUsers: number;
+        uniqueUsers: {
+            accounts: number;
+            emailOnly: number;
+            mobileOnly: number;
+        };
         monthToDateChargeMicroInr: number;
         monthToDateUsage: {
             SMS_OTP: number;
@@ -613,6 +663,11 @@ export type ApplicationDetailResponse = {
     analytics: {
         currency: 'INR';
         authUsers: number;
+        uniqueUsers: {
+            accounts: number;
+            emailOnly: number;
+            mobileOnly: number;
+        };
         monthToDateChargeMicroInr: number;
         allTimeChargeMicroInr: number;
         monthToDateUsage: {
@@ -761,6 +816,11 @@ export type GetBillingResponse = {
     analytics: {
         currency: 'INR';
         authUsers: number;
+        uniqueUsers: {
+            accounts: number;
+            emailOnly: number;
+            mobileOnly: number;
+        };
         monthToDateChargeMicroInr: number;
         allTimeChargeMicroInr: number;
         monthToDateUsage: {
@@ -1012,12 +1072,29 @@ export type PushApprovalMatchResponse = {
     trustedDeviceId: string;
     algorithm: 'ES256';
 };
+export type BeginPasskeyEnrollment = {
+    publicKey: string;
+    recoveryMode?: 'standard' | 'unavailable_device' | 'lost_all';
+};
+export type BeginPasskeyEnrollmentResponse = {
+    challenge: string;
+    algorithm: 'ES256';
+    otpVerificationId: string;
+    maskedIdentifier: string | null;
+    expiresAt: string;
+    approvalRequired: boolean;
+};
 export type RegisterPasskey = {
     response: {
-        trustedDeviceId?: string;
         publicKey: string;
         signature: string;
     };
+    otpVerificationId: string;
+    code: string;
+    existingDeviceProof?: {
+        trustedDeviceId: string;
+        signature: string;
+    };
     label?: string;
 };
 export type DeviceCredentialOptions = {
@@ -1075,13 +1152,6 @@ export type RegisterPushTokenResponse = {
 export type VerifyIdentifier = {
     identifier: string;
 };
-export type VerifyCode = {
-    requestId: string;
-    code?: string;
-    response?: {
-        [key: string]: unknown;
-    };
-};
 export type CheckVerification = {
     code?: string;
     response?: {
@@ -1106,14 +1176,9 @@ export type ApproveVerification = {
 } | {
     action: 'deny';
 };
-export type InteractionQrResponse = {
-    ref: string;
-    nonce: string;
-    issuedAt: number;
-    expiresAt: number;
-};
 export type ApproveQr = {
     applicationId: string;
+    kid?: string;
     nonce: string;
     origin: string;
     iat: number;
@@ -1164,39 +1229,17 @@ export type VerifiedUser = {
     profileUpdatedAt: string;
 };
 export type VerifyCheckResponse = {
-    status: 'profile_required';
-    profileComplete: false;
-    profileEnrollmentUrl: string;
-} | {
     status: 'verified';
     idToken: string;
     identifier: string;
     kind: 'email' | 'mobile';
-} | {
-    status: 'verified';
-    idToken: string;
-    subject: string;
-    user: VerifiedUser;
-    profileComplete: true;
-} | {
-    status: 'verified';
-    idToken: string;
-    subject: string;
-    user: VerifiedUser;
-    profileComplete: true;
-    accessToken: string;
-    refreshToken: string;
-    expiresIn: number;
 };
 export type VerifyApproveResponse = {
     status: 'verified' | 'cancelled';
 };
-export type QrConfigResponse = {
-    applicationId: string;
-    qrTtlSeconds: number;
-};
 export type QrPartnerConfigResponse = {
     applicationId: string;
+    kid: string;
     clientId: string;
     issuer: string;
     origins: Array<string>;
@@ -1211,26 +1254,6 @@ export type QrWebhookEvent = {
 export type ApproveQrResponse = {
     status: 'verified';
 };
-export type InteractionIdentifierResponse = {
-    requestId: string;
-    channel?: 'sms' | 'whatsapp' | 'email' | 'push' | 'qr' | 'passkey';
-    maskedIdentifier?: string;
-    expiresAt?: string;
-    instruction?: {
-        code: 'approve_push' | 'enter_email_otp' | 'enter_whatsapp_otp' | 'enter_sms_otp';
-        message: string;
-    };
-    alternatives?: Array<'sms' | 'whatsapp' | 'email' | 'push'>;
-    challengeNumber?: string;
-    publicKeyOptions?: {
-        [key: string]: unknown;
-    };
-};
-export type InteractionProfileRequiredResponse = {
-    status: 'profile_required';
-    profileComplete: false;
-    profileEnrollmentUrl: string;
-};
 export type UpdateProfile = {
     displayName?: string;
     addressLine1?: string;
@@ -1531,30 +1554,22 @@ export type ListOwnershipTransfersResponse = {
 export type WhatsAppWebhookEvent = {
     object?: string;
 };
-export type LogoutAll = {
-    token?: string;
-};
-export type OidcSessionTokens = {
-    access_token: string;
-    refresh_token: string;
+export type SigningJwk = {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+    kid: string;
+    alg: 'ES256';
+    use: 'sig';
 };
-export type WebAuthRefreshResponse = {
-    accessToken: string;
-    user: {
-        sub: string;
-        email: string;
-        displayName: string;
-        platformRole: 'owner' | 'admin' | 'developer' | 'viewer';
-        activeOrgId: string | null;
-        orgRoles: Array<{
-            orgId: string;
-            role: 'owner' | 'admin' | 'developer' | 'viewer';
-        }>;
-    };
-    profileEnrollmentUrl?: string;
+export type JwksResponse = {
+    keys: Array<SigningJwk>;
 };
-export type WebAuthSessionError = {
-    error: 'no_session' | 'invalid_session' | 'profile_enrollment_unavailable';
+export type OidcDiscoveryResponse = {
+    issuer: string;
+    jwks_uri: string;
+    id_token_signing_alg_values_supported: Array<'ES256'>;
 };
 export type HealthGetData = {
     body?: never;
@@ -1566,6 +1581,16 @@ export type HealthGetResponses = {
     200: HealthResponse;
 };
 export type HealthGetResponse = HealthGetResponses[keyof HealthGetResponses];
+export type OpenapiGetPublicData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/openapi.json';
+};
+export type OpenapiGetPublicResponses = {
+    200: OpenapiDocumentResponse;
+};
+export type OpenapiGetPublicResponse = OpenapiGetPublicResponses[keyof OpenapiGetPublicResponses];
 export type StorageGetData = {
     body?: never;
     path?: never;
@@ -1803,22 +1828,6 @@ export type VerifyApproveResponses = {
     200: VerifyApproveResponse;
 };
 export type VerifyApproveResponse2 = VerifyApproveResponses[keyof VerifyApproveResponses];
-export type VerifyQrSubscribeData = {
-    body?: never;
-    path?: never;
-    query: {
-        ref: string;
-    };
-    url: '/api/verify/qr/subscribe';
-};
-export type VerifyQrSubscribeErrors = {
-    400: ErrorEnvelope;
-};
-export type VerifyQrSubscribeError = VerifyQrSubscribeErrors[keyof VerifyQrSubscribeErrors];
-export type VerifyQrSubscribeResponses = {
-    200: string;
-};
-export type VerifyQrSubscribeResponse = VerifyQrSubscribeResponses[keyof VerifyQrSubscribeResponses];
 export type VerifyQrApproveData = {
     body: ApproveQr;
     path?: never;
@@ -1834,16 +1843,6 @@ export type VerifyQrApproveResponses = {
     200: ApproveQrResponse;
 };
 export type VerifyQrApproveResponse = VerifyQrApproveResponses[keyof VerifyQrApproveResponses];
-export type VerifyQrConfigData = {
-    body?: never;
-    path?: never;
-    query?: never;
-    url: '/api/verify/qr/config';
-};
-export type VerifyQrConfigResponses = {
-    200: QrConfigResponse;
-};
-export type VerifyQrConfigResponse = VerifyQrConfigResponses[keyof VerifyQrConfigResponses];
 export type VerifyQrPartnerConfigData = {
     body?: never;
     path?: never;
@@ -1858,85 +1857,26 @@ export type VerifyQrPartnerConfigResponses = {
     200: QrPartnerConfigResponse;
 };
 export type VerifyQrPartnerConfigResponse = VerifyQrPartnerConfigResponses[keyof VerifyQrPartnerConfigResponses];
-export type InteractionQrData = {
+export type OidcJwksData = {
     body?: never;
-    path: {
-        uid: string;
-    };
-    query?: never;
-    url: '/interaction/{uid}/qr';
-};
-export type InteractionQrErrors = {
-    400: ErrorEnvelope;
-};
-export type InteractionQrError = InteractionQrErrors[keyof InteractionQrErrors];
-export type InteractionQrResponses = {
-    200: InteractionQrResponse;
-};
-export type InteractionQrResponse2 = InteractionQrResponses[keyof InteractionQrResponses];
-export type InteractionIdentifierData = {
-    body: VerifyIdentifier;
-    path: {
-        uid: string;
-    };
-    query?: never;
-    url: '/interaction/{uid}/identifier';
-};
-export type InteractionIdentifierErrors = {
-    400: ErrorEnvelope;
-};
-export type InteractionIdentifierError = InteractionIdentifierErrors[keyof InteractionIdentifierErrors];
-export type InteractionIdentifierResponses = {
-    200: InteractionIdentifierResponse;
-};
-export type InteractionIdentifierResponse2 = InteractionIdentifierResponses[keyof InteractionIdentifierResponses];
-export type InteractionVerifyData = {
-    body: VerifyCode;
-    path: {
-        uid: string;
-    };
-    query?: never;
-    url: '/interaction/{uid}/verify';
-};
-export type InteractionVerifyErrors = {
-    400: ErrorEnvelope;
-};
-export type InteractionVerifyError = InteractionVerifyErrors[keyof InteractionVerifyErrors];
-export type InteractionVerifyResponses = {
-    200: InteractionProfileRequiredResponse;
-};
-export type InteractionVerifyResponse = InteractionVerifyResponses[keyof InteractionVerifyResponses];
-export type InteractionSwitchMethodData = {
-    body: SwitchVerificationMethod;
-    path: {
-        uid: string;
-        id: string;
-    };
+    path?: never;
     query?: never;
-    url: '/interaction/{uid}/verification/{id}/switch';
-};
-export type InteractionSwitchMethodErrors = {
-    400: ErrorEnvelope;
+    url: '/oauth/jwks';
 };
-export type InteractionSwitchMethodError = InteractionSwitchMethodErrors[keyof InteractionSwitchMethodErrors];
-export type InteractionSwitchMethodResponses = {
-    200: InteractionIdentifierResponse;
+export type OidcJwksResponses = {
+    200: JwksResponse;
 };
-export type InteractionSwitchMethodResponse = InteractionSwitchMethodResponses[keyof InteractionSwitchMethodResponses];
-export type OidcLogoutAllData = {
-    body: LogoutAll;
+export type OidcJwksResponse = OidcJwksResponses[keyof OidcJwksResponses];
+export type OidcDiscoveryData = {
+    body?: never;
     path?: never;
     query?: never;
-    url: '/api/oauth/logout-all';
+    url: '/.well-known/openid-configuration';
 };
-export type OidcLogoutAllErrors = {
-    400: ErrorEnvelope;
+export type OidcDiscoveryResponses = {
+    200: OidcDiscoveryResponse;
 };
-export type OidcLogoutAllError = OidcLogoutAllErrors[keyof OidcLogoutAllErrors];
-export type OidcLogoutAllResponses = {
-    200: OkResponse;
-};
-export type OidcLogoutAllResponse = OidcLogoutAllResponses[keyof OidcLogoutAllResponses];
+export type OidcDiscoveryResponse2 = OidcDiscoveryResponses[keyof OidcDiscoveryResponses];
 export type FactorsListData = {
     body?: never;
     path?: never;
@@ -1981,17 +1921,18 @@ export type FactorsPendingApprovalsResponses = {
 };
 export type FactorsPendingApprovalsResponse = FactorsPendingApprovalsResponses[keyof FactorsPendingApprovalsResponses];
 export type FactorsRegistrationOptionsData = {
-    body?: never;
+    body: BeginPasskeyEnrollment;
     path?: never;
     query?: never;
     url: '/api/verify/factors/registration-options';
 };
 export type FactorsRegistrationOptionsErrors = {
+    400: ErrorEnvelope;
     401: ErrorEnvelope;
 };
 export type FactorsRegistrationOptionsError = FactorsRegistrationOptionsErrors[keyof FactorsRegistrationOptionsErrors];
 export type FactorsRegistrationOptionsResponses = {
-    200: WebAuthnOptionsResponse;
+    200: BeginPasskeyEnrollmentResponse;
 };
 export type FactorsRegistrationOptionsResponse = FactorsRegistrationOptionsResponses[keyof FactorsRegistrationOptionsResponses];
 export type FactorsAuthenticationOptionsData = {
@@ -2072,6 +2013,74 @@ export type FactorsRegisterPushTokenResponses = {
     200: RegisterPushTokenResponse;
 };
 export type FactorsRegisterPushTokenResponse = FactorsRegisterPushTokenResponses[keyof FactorsRegisterPushTokenResponses];
+export type AuthSessionData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/auth/session';
+};
+export type AuthSessionResponses = {
+    200: WebsiteSessionResponse;
+};
+export type AuthSessionResponse = AuthSessionResponses[keyof AuthSessionResponses];
+export type AuthLogoutData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/auth/logout';
+};
+export type AuthLogoutErrors = {
+    401: ErrorEnvelope;
+    403: ErrorEnvelope;
+};
+export type AuthLogoutError = AuthLogoutErrors[keyof AuthLogoutErrors];
+export type AuthLogoutResponses = {
+    200: OkResponse;
+};
+export type AuthLogoutResponse = AuthLogoutResponses[keyof AuthLogoutResponses];
+export type AuthLogoutAllData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/auth/logout-all';
+};
+export type AuthLogoutAllErrors = {
+    401: ErrorEnvelope;
+    403: ErrorEnvelope;
+};
+export type AuthLogoutAllError = AuthLogoutAllErrors[keyof AuthLogoutAllErrors];
+export type AuthLogoutAllResponses = {
+    200: OkResponse;
+};
+export type AuthLogoutAllResponse = AuthLogoutAllResponses[keyof AuthLogoutAllResponses];
+export type AuthSneekData = {
+    body: SneekVerifyAction;
+    path?: never;
+    query?: never;
+    url: '/api/auth/sneek';
+};
+export type AuthSneekErrors = {
+    400: ErrorEnvelope;
+};
+export type AuthSneekError = AuthSneekErrors[keyof AuthSneekErrors];
+export type AuthSneekResponses = {
+    200: SneekVerifyResponse;
+};
+export type AuthSneekResponse = AuthSneekResponses[keyof AuthSneekResponses];
+export type AuthSneekWebhookData = {
+    body: QrWebhookEvent;
+    path?: never;
+    query?: never;
+    url: '/api/auth/sneek/webhook';
+};
+export type AuthSneekWebhookErrors = {
+    400: ErrorEnvelope;
+};
+export type AuthSneekWebhookError = AuthSneekWebhookErrors[keyof AuthSneekWebhookErrors];
+export type AuthSneekWebhookResponses = {
+    204: void;
+};
+export type AuthSneekWebhookResponse = AuthSneekWebhookResponses[keyof AuthSneekWebhookResponses];
 export type AccountDeleteData = {
     body?: never;
     path?: never;
@@ -2760,24 +2769,6 @@ export type QrSignInGetResponses = {
     200: QrSignInSettings;
 };
 export type QrSignInGetResponse = QrSignInGetResponses[keyof QrSignInGetResponses];
-export type QrSignInCreateSecretData = {
-    body?: never;
-    path: {
-        orgId: string;
-        appId: string;
-    };
-    query?: never;
-    url: '/api/orgs/{orgId}/applications/{appId}/qr-sign-in/secret';
-};
-export type QrSignInCreateSecretErrors = {
-    400: ErrorEnvelope;
-    401: ErrorEnvelope;
-};
-export type QrSignInCreateSecretError = QrSignInCreateSecretErrors[keyof QrSignInCreateSecretErrors];
-export type QrSignInCreateSecretResponses = {
-    201: CreateQrSigningSecretResponse;
-};
-export type QrSignInCreateSecretResponse = QrSignInCreateSecretResponses[keyof QrSignInCreateSecretResponses];
 export type QrSignInUpdateWebhookData = {
     body: UpdateQrWebhook;
     path: {
@@ -2986,14 +2977,14 @@ export type ConsoleGetOpenapiData = {
     body?: never;
     path?: never;
     query?: never;
-    url: '/api/console/openapi';
+    url: '/api/console/openapi.json';
 };
 export type ConsoleGetOpenapiErrors = {
     401: ErrorEnvelope;
 };
 export type ConsoleGetOpenapiError = ConsoleGetOpenapiErrors[keyof ConsoleGetOpenapiErrors];
 export type ConsoleGetOpenapiResponses = {
-    200: GetOpenapiDocumentResponse;
+    200: OpenapiDocumentResponse;
 };
 export type ConsoleGetOpenapiResponse = ConsoleGetOpenapiResponses[keyof ConsoleGetOpenapiResponses];
 export type ConsoleGetOrganizationData = {
@@ -3451,40 +3442,3 @@ export type WhatsappWebhookError = WhatsappWebhookErrors[keyof WhatsappWebhookEr
 export type WhatsappWebhookResponses = {
     200: unknown;
 };
-export type WebAuthLoginData = {
-    body?: never;
-    path?: never;
-    query?: never;
-    url: '/api/auth/login';
-};
-export type WebAuthCallbackData = {
-    body?: never;
-    path?: never;
-    query?: never;
-    url: '/api/auth/callback';
-};
-export type WebAuthRefreshData = {
-    body?: never;
-    path?: never;
-    query?: never;
-    url: '/api/auth/refresh';
-};
-export type WebAuthRefreshErrors = {
-    401: WebAuthSessionError;
-    503: WebAuthSessionError;
-};
-export type WebAuthRefreshError = WebAuthRefreshErrors[keyof WebAuthRefreshErrors];
-export type WebAuthRefreshResponses = {
-    200: WebAuthRefreshResponse;
-};
-export type WebAuthRefreshResponse2 = WebAuthRefreshResponses[keyof WebAuthRefreshResponses];
-export type WebAuthLogoutData = {
-    body?: never;
-    path?: never;
-    query?: never;
-    url: '/api/auth/logout';
-};
-export type WebAuthLogoutResponses = {
-    200: OkResponse;
-};
-export type WebAuthLogoutResponse = WebAuthLogoutResponses[keyof WebAuthLogoutResponses];

package/dist/index.cjs

@@ -24,10 +24,37 @@ __export(src_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekPayClient: () => SneekPayClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(src_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -52,6 +79,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -123,28 +151,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -219,5 +225,6 @@ var OrdersClient = class {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -188,5 +193,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/messages/index.cjs

@@ -23,10 +23,37 @@ __export(messages_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekMessagesClient: () => SneekMessagesClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(messages_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -51,6 +78,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -122,28 +150,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/messages/client.ts
 var SneekMessagesClient = class {
   client;
@@ -166,5 +172,6 @@ var SneekMessagesClient = class {
   SneekApiError,
   SneekClient,
   SneekMessagesClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/messages/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/messages/client.ts
 var SneekMessagesClient = class {
   client;
@@ -136,5 +141,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekMessagesClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/pay/index.cjs

@@ -24,10 +24,37 @@ __export(pay_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekPayClient: () => SneekPayClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(pay_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -52,6 +79,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -123,28 +151,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -219,5 +225,6 @@ var OrdersClient = class {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/pay/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -188,5 +193,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/verify/auth-schema.d.ts

@@ -38,12 +38,12 @@ export declare const SneekVerifyActionSchema: z.ZodUnion<[z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     action: "switch";
     requestId: string;
-    channel: "email" | "sms" | "whatsapp" | "push";
+    channel: "sms" | "whatsapp" | "email" | "push";
     proof: string;
 }, {
     action: "switch";
     requestId: string;
-    channel: "email" | "sms" | "whatsapp" | "push";
+    channel: "sms" | "whatsapp" | "email" | "push";
     proof: string;
 }>, z.ZodObject<{
     action: z.ZodLiteral<"verify">;

package/dist/verify/index.cjs

@@ -23,10 +23,37 @@ __export(verify_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekVerifyHandler: () => SneekVerifyHandler,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(verify_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -51,6 +78,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -122,28 +150,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/verify/handler.ts
 var import_node_crypto2 = require("crypto");
 var import_jose = require("jose");
@@ -419,11 +425,11 @@ var SneekVerifyHandler = class {
     const partner = await this.partnerConfig();
     if (!partner.origins.includes(origin)) return jsonResponse({ error: "Origin is not registered for QR verification" }, 403);
     const nonce = (0, import_node_crypto2.randomBytes)(32).toString("hex");
-    const ref = (0, import_node_crypto2.createHash)("sha256").update(nonce).digest("hex");
+    const ref = (0, import_node_crypto2.createHash)("sha256").update(Buffer.from(nonce, "hex")).digest("hex");
     const issuedAt = Math.floor(Date.now() / 1e3);
     const expiresAt = (issuedAt + partner.qrTtlSeconds) * 1e3;
     const bindingProof = (0, import_node_crypto2.randomBytes)(32).toString("base64url");
-    const signature = (0, import_node_crypto2.createHmac)("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
+    const signature = (0, import_node_crypto2.createHmac)("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, partner.kid, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
     await this.approvalStore.createQrSession({
       ref,
       applicationId: partner.applicationId,
@@ -431,7 +437,7 @@ var SneekVerifyHandler = class {
       bindingProofHash: this.hash(bindingProof),
       expiresAt
     });
-    return jsonResponse({ ref, nonce, issuedAt, expiresAt, signature, bindingProof }, 200);
+    return jsonResponse({ ref, nonce, issuedAt, expiresAt, kid: partner.kid, signature, bindingProof }, 200);
   }
   async qrStatus(ref, bindingProof, origin) {
     const session = await this.qrSession(ref, bindingProof, origin);
@@ -467,5 +473,6 @@ function jsonResponse(body, status) {
   SneekApiError,
   SneekClient,
   SneekVerifyHandler,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/verify/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/verify/handler.ts
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { createRemoteJWKSet, jwtVerify } from "jose";
@@ -390,11 +395,11 @@ var SneekVerifyHandler = class {
     const partner = await this.partnerConfig();
     if (!partner.origins.includes(origin)) return jsonResponse({ error: "Origin is not registered for QR verification" }, 403);
     const nonce = randomBytes(32).toString("hex");
-    const ref = createHash("sha256").update(nonce).digest("hex");
+    const ref = createHash("sha256").update(Buffer.from(nonce, "hex")).digest("hex");
     const issuedAt = Math.floor(Date.now() / 1e3);
     const expiresAt = (issuedAt + partner.qrTtlSeconds) * 1e3;
     const bindingProof = randomBytes(32).toString("base64url");
-    const signature = createHmac("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
+    const signature = createHmac("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, partner.kid, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
     await this.approvalStore.createQrSession({
       ref,
       applicationId: partner.applicationId,
@@ -402,7 +407,7 @@ var SneekVerifyHandler = class {
       bindingProofHash: this.hash(bindingProof),
       expiresAt
     });
-    return jsonResponse({ ref, nonce, issuedAt, expiresAt, signature, bindingProof }, 200);
+    return jsonResponse({ ref, nonce, issuedAt, expiresAt, kid: partner.kid, signature, bindingProof }, 200);
   }
   async qrStatus(ref, bindingProof, origin) {
     const session = await this.qrSession(ref, bindingProof, origin);
@@ -437,5 +442,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekVerifyHandler,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sneekin/sdk",
-    "version": "1.1.0",
+    "version": "1.1.1",
     "publishConfig": {
         "access": "public"
     },