Sixteen SDKs, one canonical surface

Same SIEM events. Same parser limits. Same IETF test vectors. Same env vars. Pick the language; the contract is identical.

Clone the repository

Browse on GitLab

git clone https://gitlab.com/toontoolbox/toonwebtoken.git

Backend SDKs (14)

Rust

Stable

implementations/rust/

Reference Rust crate `toonwebtoken` 1.5.0 — dual MIT/Apache-2.0. Criterion benches under 30 ms. Real ML-DSA-65 via oqs 0.11.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/rust
cargo build

Tests: 110
Bench: 9 (6 parser + 3 PQC)

Python

Stable

implementations/python/

Reference SDK with 322 tests. Modules cover hardening (TWT-A), config integrity (TWT-C), AuditTrail (TWT-D4). Real ML-DSA-65 via liboqs.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/python
pip install -r requirements.txt

Tests: 322
Bench: 9 (6 parser + 3 PQC)

TypeScript / Node.js

Stable

implementations/javascript/

190 tests. Real ML-DSA-65 via @noble/post-quantum. Jest runner, perf_hooks harness for benchmarks.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/javascript
npm install

Tests: 190
Bench: 9 (6 parser + 3 PQC)

Go

Stable

implementations/go/

`twt` package + `twt/config` sub-package. 138 tests, `-race` clean. Real ML-DSA-65 via cloudflare/circl 1.6.3 (pure Go).

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/go
go mod download

Tests: 138
Bench: 9 (6 parser + 3 PQC)

Java

Stable

implementations/java/

Maven project, JDK 17+. 179 tests. Real ML-DSA-65 via BouncyCastle 1.79.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/java
mvn install

Tests: 179
Bench: 9 (6 parser + 3 PQC)

C# / .NET 8

Stable

implementations/csharp/

185 tests (166 main + 22 TwtConfig). Real ML-DSA-65 via BouncyCastle.NET 2.6.2. xUnit suite.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/csharp
dotnet restore

Tests: 185
Bench: 9 (6 parser + 3 PQC)

C++

Stable

implementations/cpp/

CMake project. Real ML-DSA-65 via liboqs 0.15 (C API + RAII). 13 ctest suites, benchmark harness.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/cpp
mkdir build && cd build && cmake .. && make

Tests: 13 suites
Bench: 7 (4 HS256 + 3 PQC)

Swift

Stable

implementations/swift/

Swift Package Manager project. 150 tests. Real ML-DSA-65 via liboqs 0.15 SPM C-shim.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/swift
swift build

Tests: 150
Bench: 7

C

Stable

implementations/c/

Makefile build producing libtwt.a. ~90 tests. Real ML-DSA-65 via liboqs 0.15 C API.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/c
make

Tests: 52
Bench: —

VB.NET

Stable

implementations/vbnet/

156 tests. Real ML-DSA-65 via BouncyCastle.NET 2.6.2. Shares .NET 8 toolchain with C# SDK.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/vbnet
dotnet restore

Tests: 156
Bench: 7 (4 HS256 + 3 PQC)

PHP

Stable

implementations/php/

157 tests. Real ML-DSA-65 via PHP-FFI to liboqs 0.15. Docker-based CI (php:8.3-cli).

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/php
composer install

Tests: 157
Bench: 7

Perl

Stable

implementations/perl/

152 tests. Real ML-DSA-65 via FFI::Platypus 2.0 to liboqs 0.15. Docker-based CI.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/perl
cpanm --installdeps .

Tests: 152
Bench: 7

Fortran

Stable

implementations/fortran/

13 ctest suites. Real ML-DSA-65 via iso_c_binding to liboqs 0.15. CMake build, Docker CI.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/fortran
mkdir build && cd build && cmake .. && make

Tests: 13 suites
Bench: 7

Delphi

Beta

implementations/delphi/

Static review validated. DUnitX test framework. Windows-only (RAD Studio).

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/delphi

Tests: Static review
Bench: —

Frontend SDKs (2/2)

React

Beta

implementations/react/

Hooks (`useTWT`, `useAuth`), `TWTProvider`, `ProtectedRoute`, localStorage persistence with auto-refresh.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/react
npm install

Vue 3

Beta

implementations/vue/

Composables (`useTWT`, `useAuth`), `createTWTPlugin`, navigation guards, reactive state with auto-refresh.

git clone https://gitlab.com/toontoolbox/toonwebtoken.git
cd toonwebtoken/implementations/vue
npm install

Cross-SDK contract

› Same canonical surface across 16 SDKs (see SDK_REFERENCE.md).
› Same SIEM events: TWT_HONEYPOT_HIT, TWT_TOKEN_ISSUED, TWT_TOKEN_REVOKED, TWT_CONFIG_CHANGED, CONFIG_YAML_DEPRECATED, TWT_BREACH_DETECTED.
› Same env vars: TWT_CONFIG_HMAC_KEY, TWT_CONFIG_HMAC, TWT_CONFIG_PATH.
› Same parser limits: depth 10, 1 MiB total, 100 keys/object, 256-byte keys, 10 000-element arrays, 64 KiB per string.
› Same IETF test vectors: produced by the Rust crate, re-validated byte-for-byte by every conformant SDK.
› Dual MIT/Apache-2.0 license across all 16 SDKs.

Browse on GitLab