libsodium

libsodium is an open-source cryptography library that runs inside your app's process, and the driver in the crypto catalog example. It is planned as a driver behind crypto.token(), signing and sealing, with no network call and no account; today the built-in WebCrypto driver does that work. Pick it as the starting point; move signing or encryption keys to Vault Transit or a cloud key service when you need keys held outside the app.

crypto:
  driver: libsodium

Before you start

Nothing to sign up for. libsodium is a library, not a service. crypto.seal() and crypto.sign() take the keys you pass in; keep them in your secrets driver, never in code.

Configure

crypto:
  driver: libsodium

Use it

"use server";
import { crypto } from "mainsdk";

export async function prepareAccount() {
  const verifyToken = crypto.token();
  const stored = await crypto.hashHex(verifyToken);   // keep the hash, send the token
  return { verifyToken, stored };
}

Local development and testing

The same driver runs in development, tests and production, since it needs no provider. createTestApp() from @mainsdk/testing runs crypto alongside every other interface on its fake.

What MainSDK adds on top

• Modern algorithms only; there is no option to pick MD5, SHA-1 or DES, and mainsdk check carries MAIN-CRYPTO-0002.
• Keys never in code.

See Cryptography.

Limits and notes

• Keys used by this driver live with your app, not in a key service. For records with per-user erasure, use keys with a KMS.
• Customer-managed keys arrive in phase 3 (spec hsm-keys), post-quantum signatures in phase 5.

Swap to or from it

crypto:
  driver: vault-transit   # was libsodium

FAQ

Is Argon2id the only password hash? Yes. Only modern algorithms are offered, and passwords use Argon2id.

When should I move off libsodium? When your policy says signing or encryption keys must live in a key service, outside the app. Switch crypto.driver to vault-transit or cloud-kms; your calls stay the same.

Next

• Cryptography and Encryption keys
• HashiCorp Vault