Skip to main content
One-stop technical reference for the Zyfai SDK (@zyfai/sdk). This page is the canonical map of how the SDK is wired, what it exposes, and how to plug it into a backend, a frontend, or an AI agent. For per-method signatures see the Smart Wallet API and the Intelligence Layer. Create your own api key on the SDK Dashboard

Architecture

The SDK is a thin TypeScript layer that bridges your app with two backend surfaces and an on-chain Safe smart account stack. Everything is exposed through a single class: ZyfaiSDK, organized into the Smart Wallet API (execution) and the Intelligence Layer (read-only engine access). OpenAPI tables and execution vs data routing: API Reference Overview.

Installation

@zyfai/sdk is published on the public npm registry. viem is a required peer dependency. Latest version: npm
Requirements: Node 18+ or any modern browser. Your application domain must also be CORS-whitelisted on the Zyfai backend.

Configuration

SDKConfig

Supported chains

NVDAc is Coinbase’s tokenized NVIDIA share (0xb20000000000000000000078ee7ce2fE4908108C, 8 decimals). It is held only by protocols with delayed withdrawals, so it requires the yieldmaxxing strategy — see Deposit NVDAc.

Environment variables

Integration Patterns

The SDK runs in three flavors. Pick the one that matches your runtime.

Backend / Node.js (private key)

Frontend (EIP-1193 provider)

Works with any EIP-1193 provider: wagmi, Reown AppKit, window.ethereum, web3-react.

Headless analytics (no wallet)

Some methods only need the API key. This is useful for B2B dashboards, monitoring, billing.

Standard Flow

For Smart Wallet integrations, every consumer goes through the same steps:
The first sendDeposit call associates the EOA with a pre-deployed Safe that already has a signed session key, live on Base, Arbitrum, and Mainnet at once. No separate deploySafe / createSessionKey step is needed. This does not change the EOA itself.
Notes:
  • Always pass the EOA address as userAddress, never the Safe address. The SDK resolves the backend-assigned Safe.
  • First deposit makes the Safe available on all three chains immediately (not only the chainId you deposited on).
  • sendDeposit returns after transfer confirmation and lifecycle registration. Follow it with waitForDepositCredit when the UI needs investable funds.
  • Withdrawals are processed asynchronously — poll sdk.getHistory() for status.

Strategies

sendDeposit (first deposit) and updateUserProfile accept a strategy that drives the Intelligence Engine’s risk profile. Each tier is a superset of the previous one: an aggressive user also gets conservative pools, and a yieldmaxxing user gets everything.
"yieldmaxxing" is the only strategy that changes how withdrawals behave. It unlocks protocols (Ipor, Superform) that cannot be exited on demand: a redemption is requested, then claimed once the protocol releases the funds (roughly a day on Ipor, three on Superform). The agent handles both steps, but the funds are in flight in between and are missing from every balance field. Only one redemption can be in flight per pool: a second withdrawFunds on that pool throws until the entry reaches CLAIMED. See withdrawFunds and getPortfolio.

Session Keys

Session keys are assigned with the pre-deployed Safe on first deposit. They allow Zyfai’s Intelligence Engine to rebalance on the user’s behalf within strict, enforced limits. What a session key can do:
  • Move funds between approved pools on the same Safe
  • Trigger auto-compounding
  • Execute capital splitting across pools
What a session key cannot do:
  • Withdraw to any external address
  • Interact with contracts outside the curator-managed registry
  • Sign arbitrary calldata (every transaction is byte-validated by the Security Proxy Gateway)
See the Session Keys product page and Security Proxy Gateway for the full enforcement model.

Amount formatting

Token amounts for deposits and withdrawals use least decimal units (wei-style):
Earnings values (totalEarningsByToken, totalEarningsByChain, daily_total_delta_by_token) are returned as decimal strings (e.g. "421.315354"). Parse them with parseFloat() when doing arithmetic.

AI-Agent Integration

The SDK is designed to be operated by an autonomous agent, not just a human-driven app.

Type Safety

The SDK ships full TypeScript typings. Import types as needed:

Response Format

All SDK methods return consistent response objects:

Error Handling

Strategy

  • API errors are returned as response objects with error / message fields when recoverable
  • Network failures and 5xx responses are surfaced as thrown Error instances and retried with exponential backoff
  • On-chain errors bubble up from the underlying signer (viem / wallet provider). User rejections appear as standard provider errors.
  • 401 responses trigger automatic re-authentication; persistent failure throws

Pattern

Common errors

Rate Limiting

API calls are rate-limited per project key. The SDK applies automatic retry with exponential backoff on transient failures (network, 5xx, 429).

Reporting Issues

Include in every report:
  • SDK version (@zyfai/sdk)
  • Runtime (Node version, browser, framework)
  • API key prefix only (e.g. zyfai_361ad4...), never the full key
  • Error message and stack trace
  • Minimal reproduction steps
  • Expected vs actual behavior
Channels: GitHub Issues · Telegram · zyf.ai