Welcome to the Lit Actions SDK Docs. These functions can be used inside a Lit Action. You should prefix each function with "Lit.Actions." so to call "isPermittedAction()" you should do "Lit.Actions.isPermittedAction()" To understand how these functions fit together, please view the documentation for this SDK, located at https://developer.litprotocol.com/
Ask the Lit Node to sign any data using the ECDSA Algorithm with it's private key share. The resulting signature share will be returned to the Lit JS SDK which will automatically combine the shares and give you the full signature to use.
(Object)
| Name | Description |
|---|---|
params.toSign Uint8Array
|
The data to sign. Should be an array of 8-bit integers. |
params.publicKey string
|
The public key of the PKP you wish to sign with |
params.sigName string
|
You can put any string here. This is used to identify the signature in the response by the Lit JS SDK. This is useful if you are signing multiple messages at once. When you get the final signature out, it will be in an object with this signature name as the key. |
Promise<string>:
This function will return the string "success" if it works. The signature share is returned behind the scenes to the Lit JS SDK which will automatically combine the shares and give you the full signature to use.
Ask the Lit Node to sign a message using the eth_personalSign algorithm. The resulting signature share will be returned to the Lit JS SDK which will automatically combine the shares and give you the full signature to use.
(Object)
| Name | Description |
|---|---|
params.message string
|
The message to sign. Should be a string. |
params.publicKey string
|
The public key of the PKP you wish to sign with |
params.sigName string
|
You can put any string here. This is used to identify the signature in the response by the Lit JS SDK. This is useful if you are signing multiple messages at once. When you get the final signature out, it will be in an object with this signature name as the key. |
Promise<string>:
This function will return the string "success" if it works. The signature share is returned behind the scenes to the Lit JS SDK which will automatically combine the shares and give you the full signature to use.
(Uint8array)
the message to sign
(string)
the public key of the PKP
(string)
the name of the signature
(string)
the name of the signing scheme
one of the following
"EcdsaK256Sha256"
"EcdsaP256Sha256"
"EcdsaP384Sha384"
"SchnorrEd25519Sha512"
"SchnorrK256Sha256"
"SchnorrP256Sha256"
"SchnorrP384Sha384"
"SchnorrRistretto25519Sha512"
"SchnorrEd448Shake256"
"SchnorrRedJubjubBlake2b512"
"SchnorrK256Taproot"
"SchnorrRedDecaf377Blake2b512"
"SchnorrkelSubstrate"
"Bls12381G1ProofOfPossession"
Uint8array:
The resulting signature share
Sign data using the Lit Action's own cryptographic identity derived from its IPFS CID. This allows actions to sign as themselves (not as a PKP), enabling autonomous agent behavior, action-to-action authentication, and verifiable computation results.
The action's keypair is deterministically derived from: keccak256("lit_action_" + actionIpfsCid) The same action IPFS CID always generates the same keypair across all nodes.
(Object)
| Name | Description |
|---|---|
params.toSign Uint8Array
|
The message to sign as an array of 8-bit integers |
params.sigName string
|
The name to identify this signature in the response |
params.signingScheme string
|
The signing algorithm to use. Must be one of: "EcdsaK256Sha256", "EcdsaP256Sha256", "EcdsaP384Sha384", "SchnorrEd25519Sha512", "SchnorrK256Sha256", "SchnorrP256Sha256", "SchnorrP384Sha384", "SchnorrRistretto25519Sha512", "SchnorrEd448Shake256", "SchnorrRedJubjubBlake2b512", "SchnorrK256Taproot", "SchnorrRedDecaf377Blake2b512", "SchnorrkelSubstrate", "Bls12381G1ProofOfPossession" |
Promise<Uint8Array>:
The resulting signature that can be verified using verifyActionSignature
Sign with ECDSA and automatically combine signature shares from all nodes into a complete signature
(Object)
| Name | Description |
|---|---|
params.toSign Uint8Array
|
The message to sign |
params.publicKey string
|
The public key of the PKP |
params.sigName string
|
The name of the signature |
Promise<Uint8Array>:
The resulting combined signature
Sign with any signing scheme and automatically combine signature shares from all nodes into a complete signature
(Object)
| Name | Description |
|---|---|
params.toSign Uint8Array
|
The message to sign |
params.publicKey string
|
The public key of the PKP |
params.sigName string
|
The name of the signature |
params.signingScheme string
|
The signing scheme. Must be one of: "EcdsaK256Sha256", "EcdsaP256Sha256", "EcdsaP384Sha384", "SchnorrEd25519Sha512", "SchnorrK256Sha256", "SchnorrP256Sha256", "SchnorrP384Sha384", "SchnorrRistretto25519Sha512", "SchnorrEd448Shake256", "SchnorrRedJubjubBlake2b512", "SchnorrK256Taproot", "SchnorrRedDecaf377Blake2b512", "SchnorrkelSubstrate", "Bls12381G1ProofOfPossession" |
Promise<Uint8Array>:
The resulting combined signature
Verify that a signature was created by a specific Lit Action using signAsAction. This enables action-to-action authentication, verifiable computation, and building trust chains between actions without requiring PKP ownership.
(Object)
| Name | Description |
|---|---|
params.signingScheme string
|
The signing algorithm. Must be one of: "EcdsaK256Sha256", "EcdsaP256Sha256", "EcdsaP384Sha384", "SchnorrEd25519Sha512", "SchnorrK256Sha256", "SchnorrP256Sha256", "SchnorrP384Sha384", "SchnorrRistretto25519Sha512", "SchnorrEd448Shake256", "SchnorrRedJubjubBlake2b512", "SchnorrK256Taproot", "SchnorrRedDecaf377Blake2b512", "SchnorrkelSubstrate", "Bls12381G1ProofOfPossession" |
params.actionIpfsCid string
|
The IPFS CID of the Lit Action that should have created the signature |
params.toSign Uint8Array
|
The message that was signed |
params.signOutput string
|
The signature output from signAsAction (as a string) |
Promise<boolean>:
true if the signature was created by the specified action, false otherwise
Check if a given IPFS ID is permitted to sign using a given PKP tokenId
Promise<boolean>:
A boolean indicating whether the IPFS ID is permitted to sign using the PKP tokenId
Check if a given wallet address is permitted to sign using a given PKP tokenId
Promise<boolean>:
A boolean indicating whether the wallet address is permitted to sign using the PKP tokenId
Check if a given auth method is permitted to sign using a given PKP tokenId
(Object)
| Name | Description |
|---|---|
params.tokenId string
|
The tokenId to check |
params.authMethodType number
|
The auth method type. This is an integer. This mapping shows the initial set but this set may be expanded over time without updating this contract: https://github.com/LIT-Protocol/LitNodeContracts/blob/main/contracts/PKPPermissions.sol#L25 |
params.userId Uint8Array
|
The id of the auth method to check expressed as an array of unsigned 8-bit integers (a Uint8Array) |
Promise<boolean>:
A boolean indicating whether the auth method is permitted to sign using the PKP tokenId
Get the full list of actions that are permitted to sign using a given PKP tokenId
Promise<Array<string>>:
An array of IPFS IDs of lit actions that are permitted to sign using the PKP tokenId
Get the full list of addresses that are permitted to sign using a given PKP tokenId
Promise<Array<string>>:
An array of addresses that are permitted to sign using the PKP tokenId
Get the full list of auth methods that are permitted to sign using a given PKP tokenId
Promise<Array<Object>>:
An array of auth methods that are permitted to sign using the PKP tokenId. Each auth method is an object with the following properties: auth_method_type, id, and user_pubkey (used for web authn, this is the pubkey of the user's authentication keypair)
Get the permitted auth method scopes for a given PKP tokenId and auth method type + id
(Object)
| Name | Description |
|---|---|
params.tokenId string
|
The tokenId to check |
params.authMethodType string
|
The auth method type to look up |
params.userId Uint8Array
|
The id of the auth method to check expressed as an array of unsigned 8-bit integers (a Uint8Array) |
params.maxScopeId number
|
The maximum scope id to check. This is an integer. |
Promise<Array<boolean>>:
An array of booleans that define if a given scope id is turned on. The index of the array is the scope id. For example, if the array is [true, false, true], then scope ids 0 and 2 are turned on, but scope id 1 is turned off.
Accessed via Lit.Actions.*.
Get the public key for a Lit Action's cryptographic identity. This can be used to verify signatures created by signAsAction, or to get the public key of any action (including actions you didn't create) for verification purposes.
The public key is deterministically derived from: keccak256("lit_action_" + actionIpfsCid) and will always be the same for a given action IPFS CID and signing scheme.
(Object)
| Name | Description |
|---|---|
params.signingScheme string
|
The signing algorithm. Must be one of: "EcdsaK256Sha256", "EcdsaP256Sha256", "EcdsaP384Sha384", "SchnorrEd25519Sha512", "SchnorrK256Sha256", "SchnorrP256Sha256", "SchnorrP384Sha384", "SchnorrRistretto25519Sha512", "SchnorrEd448Shake256", "SchnorrRedJubjubBlake2b512", "SchnorrK256Taproot", "SchnorrRedDecaf377Blake2b512", "SchnorrkelSubstrate", "Bls12381G1ProofOfPossession" |
params.actionIpfsCid string
|
The IPFS CID of the Lit Action |
Promise<Uint8Array>:
The public key for the action
Gets latest nonce for the given address on a supported chain
Promise<string>:
The token ID as a string
Claim a key through a key identifier, the result of the claim will be added to claim_id
under the keyId given.
Converts a PKP public key to a PKP token ID by hashing it with keccak256
Promise<string>:
The token ID as a string
Helpers available inside actions as Lit.Actions.*.
Checks a condition using the Lit condition checking engine. This is the same engine that powers our Access Control product. You can use this to check any condition that you can express in our condition language. This is a powerful tool that allows you to build complex conditions that can be checked in a decentralized way. Visit https://developer.litprotocol.com and click on the "Access Control" section to learn more.
(Object)
| Name | Description |
|---|---|
params.conditions Array<Object>
|
An array of access control condition objects |
params.authSig Object
|
The AuthSig to use for the condition check. For example, if you were checking for NFT ownership, this AuthSig would be the signature from the NFT owner's wallet. |
params.chain string
|
The chain this AuthSig comes from |
Promise<boolean>:
A boolean indicating whether the condition check passed or failed
Set the response returned to the client
Call a child Lit Action
Promise<string>:
The response from the child Lit Action. Note that any signatures performed by the child Lit Action will be automatically combined and returned with the parent Lit Action to the Lit JS SDK client.
Call a smart contract
Promise<string>:
The response from calling the contract
Broadcast a message to all connected clients and collect their responses
Promise<string>:
The collected responses as a json array
Run a function only once across all nodes using leader election
(Object)
| Name | Description |
|---|---|
params.waitForResponse boolean
|
Whether to wait for a response or not - if false, the function will return immediately |
params.name string
|
Optional name for this runOnce invocation |
(Function)
The async function to run on the leader node
Promise<string>:
The response from the function if waitForResponse is true
Get the RPC URL for a given blockchain
Promise<string>:
The RPC URL for the chain
Encrypt data using BLS encryption with access control conditions
Promise<{ciphertext: string, dataToEncryptHash: string}>:
An object containing the ciphertext and the hash of the data that was encrypted
Decrypt and combine the provided ciphertext
Important Considerations:
conditionType: "evmContract".Promise<string>:
The decrypted and combined data
Decrypt to a single node
Promise<string>:
The decrypted data
Decrypt data using AES with a symmetric key
(Object)
| Name | Description |
|---|---|
params.symmetricKey Uint8Array
|
The AES symmetric key |
params.ciphertext Uint8Array
|
The ciphertext to decrypt |
Promise<string>:
The decrypted plaintext
Utility conversions exposed on Lit.Actions.*.
Convert a Uint8Array to a string. This is a re-export of this function: https://www.npmjs.com/package/uint8arrays#tostringarray-encoding--utf8
(Uint8Array)
The Uint8Array to convert
(string)
The encoding to use. Defaults to "utf8"
string:
The string representation of the Uint8Array
Convert a string to a Uint8Array. This is a re-export of this function: https://www.npmjs.com/package/uint8arrays#fromstringstring-encoding--utf8
Uint8Array:
The Uint8Array representation of the string
Authentication context injected as Lit.Auth.* during execution.
Globals automatically available inside the Lit Action runtime.
Global reference to the Lit Actions namespace for convenience.
This alias is injected in the Lit Action execution environment and mirrors Lit.Actions.
Global reference to the Lit Auth namespace for convenience.
This alias is injected in the Lit Action execution environment and mirrors Lit.Auth.
The ethers.js v5 API exposed to Lit Actions for interacting with EVM chains. Includes wallets, providers, contracts, and cryptographic helpers.
The jsonwebtoken library exposed to Lit Actions for JWT encoding and verification.
Authentication Context available inside a Lit Action via Lit.Auth.
This namespace is injected at runtime and is read-only. It contains contextual information about the current execution and authentication.
Stack of action IPFS IDs tracking the parent/child call hierarchy. When a parent action calls a child action, the child's IPFS ID is pushed onto this stack.
The address derived from the authentication signature, if present; otherwise null.
Type: (string | null)
Array of authentication method contexts used for this execution.
Type: Array<{userId: string, appId: string, authMethodType: number, lastRetrievedAt: string, expiration: number, usedForSignSessionKeyRequest: boolean}>
Array of resources (URIs) from SIWE/session signatures associated with this execution.
Custom authentication resource string.
Type: string