ton-devtools-auth-sdk

Server-side TON Connect 2.0 proof verification for ICP-compatible services.

Part of the ton-devtools monorepo.

What it does

Implements the server-side authentication pipeline:

• §5.2 — TON proof message construction and ed25519 verification
• §5.3 — On-chain public key resolution via Toncenter API v2 (or TRMS)
• §5.6 — Single-use nonce management with TTL (replay attack prevention)
• §10.2 — Timestamp skew enforcement (±300 s)

Installation

pip install ton-devtools-auth-sdk

Quick Start

from ton_devtools_auth import ICPAuthenticator

auth = ICPAuthenticator(
    rpc_base_url="https://toncenter.com/api/v2",
    rpc_api_key="YOUR_KEY",
    domain="id.yourapp.com",
)

# POST /auth/ton/connect
nonce = auth.issue_nonce()          # store and return to client

# POST /auth/ton/verify
result = await auth.verify(
    wallet_address=body.wallet_address,
    nonce=body.nonce,
    signature=body.signature,
    public_key=body.public_key,
    timestamp=body.timestamp,
    domain=body.domain,
)
# result.wallet_address, result.public_key, result.on_chain_verified

Nonce storage backends

from ton_devtools_auth.nonce import NonceManager, InMemoryNonceStore

# Testing / single-replica
auth = ICPAuthenticator(nonce_store=InMemoryNonceStore())

# Production: bring your own Redis client
class RedisNonceStore:
    def __init__(self, redis): self._r = redis
    def set(self, key, value, ttl): self._r.set(key, value, ex=ttl)
    def get(self, key): return self._r.get(key)
    def delete(self, key): return bool(self._r.delete(key))

auth = ICPAuthenticator(nonce_store=RedisNonceStore(redis_client))

Pointing at TRMS for testing

auth = ICPAuthenticator(
    rpc_base_url="http://localhost:8080",  # ton-devtools-rpc-mock
    domain="localhost",
)

License

MIT