Production SDKs

RANNTA PQ Cloud provides a TypeScript SDK and a fail-closed Go API client. Both keep the final business decision in the customer backend. Private-key custody remains customer-side.

TypeScript

import { RanntaPqClient } from "@rannta/pq";

const pq = new RanntaPqClient({
  baseUrl: "https://pq.rannta.com",
  apiKey: process.env.RANNTA_PQ_API_KEY!,
});

const result = await pq.verifyHybrid({
  payload,
  publicKeyHex,
  keyVersion: payload.key_version,
  mlDsa65SignatureHex: signature,
  classicalVerified: true,
});

if (result.valid !== true) throw new Error("Rejected");

Go

client := pqcloud.NewClient(os.Getenv("RANNTA_PQ_API_KEY"))

verdict := client.VerifyAuthorization(ctx, pqcloud.HybridRequest{
    Payload: payload,
    PublicKeyHex: publicKeyHex,
    KeyVersion: payload.KeyVersion,
    MLDSA65SignatureHex: signatureHex,
    ClassicalVerified: true,
})

if verdict != "Valid" {
    return errors.New("authorization rejected")
}

Fail-closed contract

• Return or continue as Valid only after an explicit authenticated successful verification response.
• Timeout, transport failure, malformed JSON, policy rejection or valid: false must be treated as Rejected.
• Set classical_verified=true only after the customer's existing classical authorization succeeds.
• Keep API keys server-side and PQ private keys in the customer signer/HSM.

Implementation references

The repository contains the TypeScript implementation under sdk/typescript and the Go client under sdk/go. Request and response fields are checked against the published RANNTA PQ Cloud OpenAPI contract.

See exchange, treasury and validator integration examples.