Functions

createLitClient({ network })

Parameters

NagaNetworkModule

required

The network to connect to.

import { nagaDev } from "@lit-protocol/networks";
const litClient = await createLitClient({ network: nagaDev });

Returns

object

Complete litClient object with all returned methods.

chain.raw.pkpSign

Signs arbitrary bytes with a PKP using the specified signing scheme on the chosen chain.

Parameters

object

Show properties

string

required

0x‑prefixed PKP public key.

Uint8Array | ArrayLike<number>

required

Bytes to sign. If hashing is enabled, the hash of this payload is signed.

enum

required

Signing scheme to use.

Show allowed values

string

ECDSA over secp256k1 with SHA‑256 prehash.

string

ECDSA over P‑256 with SHA‑256 prehash.

string

ECDSA over P‑384 with SHA‑384 prehash.

string

Schnorr over Ed25519 with SHA‑512 prehash.

string

Schnorr over secp256k1 with SHA‑256 prehash.

string

Schnorr over P‑256 with SHA‑256 prehash.

string

Schnorr over P‑384 with SHA‑384 prehash.

string

Schnorr over Ristretto25519 with SHA‑512 prehash.

string

Schnorr over Ed448 with SHAKE‑256 prehash.

string

Schnorr over Jubjub (red) with BLAKE2b‑512 prehash.

string

Schnorr over secp256k1 (Taproot) variant.

string

Schnorr over Decaf377 (red) with BLAKE2b‑512 prehash.

string

Schnorrkel (Substrate) variant.

Show chain compatibility

default

Defaults to EcdsaK256Sha256.

supported

Supports EcdsaK256Sha256, SchnorrK256Sha256, SchnorrK256Taproot.

enum

required

Target chain; determines hashing (e.g. keccak256 for ethereum, sha256 for bitcoin).

Show allowed values

string

Uses keccak256 prehashing when hashing is enabled.

string

Uses SHA‑256 prehashing when hashing is enabled.

string

Reserved in schema.

string

Reserved in schema.

AuthenticationContext

required

Authorisation/session context

bigint

Optional maximum price the user is willing to pay for this request.

boolean

Optional. Controls message pre‑hashing before signing.

Show behaviour

boolean

Do not transform toSign; the payload is signed as‑is. Use when you already computed the digest (e.g. EIP‑712 typed data, pre‑computed tx/message hash).

boolean

Auto‑hash toSign according to signingScheme and chain via LitMessageSchema.

Show auto‑hash mapping (ECDSA)

keccak256

Hash function used before signing.

keccak256

Hash function used before signing.

keccak384

Hash function used before signing.

sha256

Hash function used before signing.

sha256

Hash function used before signing.

sha384

Hash function used before signing.

Show auto‑hash mapping (FROST)

none

No hashing is applied; toSign is signed as‑is.

Show notes

experimental

Auto‑hash mapping is not defined; avoid relying on auto‑hash with these chains.

guidance

Compute the EIP‑712 digest client‑side and set bypassAutoHashing=true to sign the digest directly.

Returns

LitNodeSignature Object

Show properties

string

The final signature for the request.

string

0x‑prefixed verifying (compressed) public key used to produce the signature.

string

0x‑prefixed hex of the exact payload that was signed (post‑hashing if applicable).

number | null

Recovery identifier when applicable to the scheme (0 or 1; may be null).

string

0x‑prefixed PKP public key associated with the signature.

string

The signature type/scheme used

executeJs

Execute a Lit Action (JS) on the network.

Parameters

object

Show properties

string

Inline JS code to run. Either code or ipfsId must be provided.

string

IPFS CID of a Lit Action to run. Either code or ipfsId must be provided.

any | { publicKey?: string; sigName?: string; ... }

Parameters injected into the Lit Action runtime before execution.

AuthenticationContext

required

Authorisation/session context for node authorisation.

bigint

Optional maximum price the user is willing to pay.

Returns

ExecuteJsResponse Object

Show properties

boolean

string | object

The action-defined response payload.

string

Aggregated logs from nodes.

object | any

Signature map when action performs signing.

record

Optional claim results when present.

object

Optional debug info (allNodeResponses, allNodeLogs, rawNodeHTTPResponses).

encrypt

Encrypt data with access control conditions using BLS.

Parameters

object

Show properties

string | object | any[] | Uint8Array

required

The data to encrypt. Strings/objects/arrays are internally converted to bytes. Objects/arrays are JSON-stringified first.

string

required

Target chain context for condition evaluation.

ACC[]

Standard access control conditions (ACC). Provide one of ACC, evmContractConditions, solRpcConditions, or unifiedAccessControlConditions.

EVM ACC[]

EVM-specific contract conditions (mutually exclusive with other condition types).

Solana ACC[]

Solana RPC conditions (mutually exclusive with other condition types).

Unified ACC[]

Unified access control conditions (mutually exclusive with other condition types).

object

Optional metadata to describe the data being encrypted.

Show properties

'uint8array' | 'string' | 'json' | 'buffer' | 'image' | 'video' | 'file'

Expected data type for downstream conversion on decrypt.

string

MIME type for file-like data.

string

Original filename for file-like data.

number

File size in bytes.

record

Arbitrary custom metadata.

Returns

EncryptResponse Object

Show properties

string

Base64-encoded ciphertext.

string

SHA-256 hash (hex) of the plaintext data.

object

Echo of provided metadata or inferred data type where applicable.

decrypt

Decrypt data previously encrypted with access control conditions.

Parameters

object

Show properties

EncryptResponse

Optional. Pass the full encrypted object from encrypt(). If omitted, provide fields below individually.

string

Base64-encoded ciphertext (required if data is not provided).

string

SHA-256 hash (hex) of the original plaintext (required if data is not provided).

ACC[]

One of ACC, evmContractConditions, solRpcConditions, or unifiedAccessControlConditions (must match encryption).

EVM ACC[]

Solana ACC[]

Unified ACC[]

string

Target chain context for condition evaluation.

AuthenticationContext

Authorisation/session context for node authorisation.

bigint

Optional maximum price the user is willing to pay for this request.

Returns

DecryptResponse Object

Show properties

Uint8Array

The raw decrypted bytes.

string | object | Buffer | Blob | File

Present when metadata.dataType was provided and conversion is applicable.

object

Metadata echo including dataType and optional file info.

mintWithEoa

Mint a PKP using an EOA.

Parameters

object

Show properties

Account | WalletClient | Signer

required

The signing account that will perform the mint on-chain.

Returns

AuthServerTx<PKPData>

Show properties

string

Transaction hash of the mint.

PKPData Object

Show properties

bigint

PKP token ID.

string

0x-hex uncompressed public key.

string

Derived 0x-hex Ethereum address.

mintWithAuth

Mint a PKP using an authentication method.

Parameters

object

Show properties

Account | WalletClient | Signer

required

The signing account that will perform the mint on-chain.

AuthData

required

Auth method payload (e.g., from ViemAccountAuthenticator): includes authMethodType, authMethodId, optional accessToken.

string[] | number[]

required

Permission scopes to attach to the minted PKP.

Returns

AuthServerTx<PKPData>

Show properties

string

PKPData

mintWithCustomAuth

Mint a PKP using custom authentication (Lit Action validator or IPFS CID).

Parameters

object

Show properties

Account | WalletClient | Signer

required

The signing account for on-chain operations.

AuthData (without accessToken)

required

Authentication method details used alongside the validation Lit Action.

string

required

Lit Action IPFS CID (must start with “Qm” and be ≥ 46 chars).

'no-permissions' | 'sign-anything' | 'personal-sign'

required

Initial permission scope to grant.

boolean

default:"false"

If true, add the PKP’s own address as a permitted address.

boolean

default:"true"

If true, transfers the PKP to itself after minting.

Returns

object

Show properties

string

Echo of the provided Lit Action CID.

PKPData | any

Mint result and PKP details from the chain API.

authService.mintWithAuth

Mint a PKP via the Auth Service. Parameters and returns mirror mintWithAuth.

Parameters

object

Show properties

Account | WalletClient | Signer

AuthData

string[] | number[]

string

Optional. Override the Auth Service base URL; defaults to the network’s configured value.

Returns

AuthServerTx<PKPData>

getPKPPermissionsManager

Create a PKP permissions manager instance.

Parameters

object

Hide properties

object

required

PKP identifier. Exactly one of the following must be provided.

Show one of

string

PKP token ID (stringified bigint).

string

0x‑prefixed uncompressed PKP public key.

string

0x‑prefixed PKP Ethereum address.

Account | WalletClient | Signer

required

Account used for permission transactions and reads.

Returns

PKPPermissionsManager Object

Hide properties

Promise<LitTxVoid>

Add a permitted Lit Action.

Show params

string

required

Lit Action IPFS CID.

ScopeString[]

required

Permission scopes (e.g., ‘sign-anything’).

Show example

await manager.addPermittedAction({ ipfsId: "Qm...", scopes: ["sign-anything"] });

Promise<LitTxVoid>

Add a permitted address.

Show params

string

required

0x‑prefixed address to permit.

ScopeString[]

required

Permission scopes.

Show example

await manager.addPermittedAddress({ address: "0xUser...", scopes: ["sign-anything"] });

Promise<LitTxVoid>

Permit an authentication method.

Show params

string | number | bigint

required

string

required

string

required

ScopeString[]

required

Show example

await manager.addPermittedAuthMethod({ authMethodType: 1, authMethodId: "0x...", userPubkey: "0x...", scopes: ["sign-anything"] });

Promise<LitTxVoid>

Permit a scope for an auth method.

Show params

string | number | bigint

required

string

required

string | number | bigint

required

Show example

await manager.addPermittedAuthMethodScope({ authMethodType: 1, authMethodId: "0x...", scopeId: 0 });

Promise<LitTxVoid>

Show params

string

required

Show example

await manager.removePermittedAction({ ipfsId: "Qm..." });

Promise<LitTxVoid>

Show params

string

required

Show example

await manager.removePermittedAddress({ address: "0xUser..." });

Promise<LitTxVoid>

Show params

string | number | bigint

required

string

required

Show example

await manager.removePermittedAuthMethod({ authMethodType: 1, authMethodId: "0x..." });

Promise<LitTxVoid>

Show params

string | number | bigint

required

string

required

string | number | bigint

required

Show example

await manager.removePermittedAuthMethodScope({ authMethodType: 1, authMethodId: "0x...", scopeId: 0 });

Promise<boolean>

Show params

string

required

Show example

const ok = await manager.isPermittedAction({ ipfsId: "Qm..." });

Promise<boolean>

Show params

string

required

Show example

const ok = await manager.isPermittedAddress({ address: "0xUser..." });

Promise<readonly 0x-hex[]>

Promise<readonly 0x-hex[]>

Promise<readonly AuthMethod[]>

Promise<readonly boolean[]>

Show params

number

required

string

required

number

Promise<PermissionsContext>

Returns consolidated permissions (actions, addresses, authMethods).

Promise<void>

Batch perform add/remove operations.

Show operations (array of)

object

object

object

object

object

object

object

object

Show example

await manager.batchUpdatePermissions([
  { type: 'addAddress', address: '0xUser...', scopes: ['sign-anything'] },
  { type: 'addAction', ipfsId: 'Qm...', scopes: ['sign-anything'] },
]);

Promise<void>

Remove all addresses, auth methods, and known test actions.

getPaymentManager

Get a Payment Manager for Ledger contract operations.

Parameters

object

Show properties

Account | WalletClient | Signer

required

The account used for deposits, withdrawals, and queries.

Returns

PaymentManager Object

Hide properties

Promise<LitTxVoid>

Deposit funds to your own account.

Show params

string

required

Amount to deposit in ETH (string), internally converted to Wei.

Show example

await paymentManager.deposit({ amountInEth: "0.1" });

Promise<LitTxVoid>

Deposit funds for another user.

Show params

string

required

string

required

Show example

await paymentManager.depositForUser({ userAddress: "0x...", amountInEth: "0.25" });

Promise<PaymentBalance>

Get total and available balances for a user.

Show params

string

required

Show example

const bal = await paymentManager.getBalance({ userAddress: "0x..." });
console.log(bal.totalBalance, bal.availableBalance);

Promise<LitTxVoid>

Request withdrawal (starts delay period).

Show params

string

required

Show example

await paymentManager.requestWithdraw({ amountInEth: "0.05" });

Promise<LitTxVoid>

Execute withdrawal after delay.

Show params

string

required

Show example

await paymentManager.withdraw({ amountInEth: "0.05" });

Promise<WithdrawRequestInfo>

Get current withdrawal request for a user.

Show params

string

required

Show example

const info = await paymentManager.getWithdrawRequest({ userAddress: "0x..." });

Promise<{ delaySeconds: string; raw: bigint }>

Get global withdrawal delay in seconds.

Show example

const delay = await paymentManager.getWithdrawDelay();

Promise<{ canExecute: boolean; timeRemaining?: number; withdrawRequest: WithdrawRequestInfo }>

Check whether a user’s withdrawal can be executed now.

Show params

string

required

Show example

const { canExecute, timeRemaining } = await paymentManager.canExecuteWithdraw({ userAddress: "0x..." });

Promise<LitTxVoid>

Delegate payments to a user.

Show params

string

required

Show example

await paymentManager.delegatePayments({ userAddress: "0xUser..." });

Promise<LitTxVoid>

Undelegate payments from a user.

Show params

string

required

Show example

await paymentManager.undelegatePayments({ userAddress: "0xUser..." });

Promise<LitTxVoid>

Delegate payments to multiple users.

Show params

string[]

required

Show example

await paymentManager.delegatePaymentsBatch({ userAddresses: ["0xA...","0xB..."] });

Promise<LitTxVoid>

Undelegate payments from multiple users.

Show params

string[]

required

Show example

await paymentManager.undelegatePaymentsBatch({ userAddresses: ["0xA...","0xB..."] });

Promise<LitTxVoid>

Set payment restriction for caller.

Show params

string

required

string

required

string

required

Show example

await paymentManager.setRestriction({ totalMaxPrice: "1000000000000000000", requestsPerPeriod: "100", periodSeconds: "86400" });

Promise<string[]>

List payers for a user.

Show params

string

required

Show example

const payers = await paymentManager.getPayers({ userAddress: "0xUser..." });

Promise<string[]>

List users for a payer.

Show params

string

required

Show example

const users = await paymentManager.getUsers({ payerAddress: "0xPayer..." });

Promise<{ totalMaxPrice: string; requestsPerPeriod: string; periodSeconds: string; raw: Restriction }>

Get restriction for a payer.

Show params

string

required

Show example

const r = await paymentManager.getRestriction({ payerAddress: "0xPayer..." });

Promise<{ payers: string[][]; restrictions: { totalMaxPrice: string; requestsPerPeriod: string; periodSeconds: string; }[][]; raw: { payers: string[][]; restrictions: Restriction[][] } }>

Batch get payers and restrictions for users.

Show params

string[]

required

Show example

const res = await paymentManager.getPayersAndRestrictions({ userAddresses: ["0xA...","0xB..."] });

viewPKPPermissions

View current permissions context for a PKP.

Parameters

{ tokenId?: string; pubkey?: string; address?: string }

required

Returns

object

Show properties

readonly 0x-hex[]

readonly 0x-hex[]

readonly object[]

viewPKPsByAddress

List PKPs owned by an address.

Parameters

object

Show properties

string

required

Address whose PKPs to fetch.

{ limit?: number; offset?: number }

PKPStorageProvider

Returns

PaginatedPKPsResponse

Show properties

PKPInfo[]

{ limit: number; offset: number; total: number; hasMore: boolean }

getPkpViemAccount

Create a Viem-compatible account backed by a PKP.

Parameters

object

Show properties

string | Hex

required

0x-prefixed PKP public key.

AuthenticationContext

required

Authorisation context used for signing sessions.

Chain

required

Viem chain configuration used by the returned account.

Returns

Viem Account Object

Show properties

functions

Standard Viem account methods that route to PKP signing under the hood.

Returns

LitNodeSignature Object

Show properties

string

The final signature for the request.

string

0x‑prefixed verifying (compressed) public key used to produce the signature.

string

0x‑prefixed hex of the exact payload that was signed (post‑hashing if applicable).

number | null

Recovery identifier when applicable to the scheme (0 or 1; may be null).

string

0x‑prefixed PKP public key associated with the signature.

string

The signature type/scheme used (e.g. ECDSA, Schnorr).

utils.getDerivedKeyId

Resolve the uncompressed PKP public key for a given derived key identifier.

Parameters

string

required

0x-prefixed bytes32 identifier (for example, keccak256(stringToBytes(lit_action_${ipfsCid}))).

Returns

Promise<string>

0x-prefixed uncompressed public key as returned by the PubkeyRouter contract.

Example

import { keccak256, stringToBytes } from "viem";

const derivedKeyId = keccak256(stringToBytes(`lit_action_${ipfsCid}`));
const derivedPubkey = await litClient.utils.getDerivedKeyId(derivedKeyId);

Note: this helper currently calls PubkeyRouter.getDerivedPubkey with the default Naga key set (naga-keyset1). See the Derive Lit Action Public Keys guide for an end-to-end workflow.

getChainConfig

Returns the chain configuration for the current network.

Parameters

none

Returns

ChainConfig

Show properties

Chain

Viem chain configuration used by the returned account.

string

RPC URL for the chain.

disconnect

Stop background state updates and release resources.

Parameters

none

Returns

void

⌘I