# thirdweb bundles contract calls, in-app wallets and server wallets into one SDK

> thirdweb is a TypeScript web3 SDK published as a monorepo of focused packages, with a core package for browser, Node and mobile apps, React hooks and components, in-app wallets, account abstraction and a backend server wallet, alongside separate SDKs for thirdweb's API, Engine executor and Insight indexer. The code is open source, but the services behind the client IDs are not.

**thirdweb-dev/js** — Best in class web3 SDKs for Browser, Node and Mobile apps

- Repository: https://github.com/thirdweb-dev/js
- Website: https://thirdweb.com
- Stars: 641 · Forks: 686
- Language: TypeScript
- License: Apache-2.0
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/thirdweb-dev-js

## One SDK over a set of hosted services

thirdweb describes itself as the all-in-one web3 SDK for Browser, Node and Mobile apps, and the repository is the TypeScript implementation behind that claim.

The structure is a set of packages rather than one library. The core thirdweb package provides the all-in-one web3 functionality for browser, Node and mobile applications. Alongside it sit the adapters and the type safe API wrappers: a react-native-adapter with the required polyfills and configuration for React Native, a wagmi-adapter that lets you use thirdweb's in-app wallets with wagmi, an api package that is a TypeScript SDK for thirdweb's API combining all of thirdweb products, an engine package for Engine, thirdweb's backend onchain executor service, and an insight package for Insight, thirdweb's multichain indexer service.

That layout is the important part for an adopter. The word all-in-one describes the developer experience, not the dependency graph. A React Native project needs the adapter package, a team already on wagmi needs the wagmi adapter, and a backend that wants to execute a transaction without a user present uses the engine package.

The repository is a pnpm workspace with turbo, the primary language is TypeScript, and the last push was on 2026-10-19, with thirdweb@5.122.0 published on 2026-10-12 and the wagmi adapter at 0.2.221 released alongside it.

## What the core package claims to cover

The core package feature list is short enough to read as a specification of what the SDK is for.

There are type-safe contract and transaction APIs, so the calls you make against a contract and the transactions you send are typed rather than stringly typed. There are in-app wallets with social and email login, which means the SDK can create and hold a wallet for a user without that user having installed anything, and there is support for 500 or more external wallets, so the same app can also offer MetaMask and the rest through one interface.

Account abstraction support is listed, with ERC4337 and EIP7702 named. There is built-in infrastructure, with RPC, bundler, paymaster and indexer all named as things the SDK covers rather than something you assemble yourself. There are React hooks and UI components, including a connect button. Automatic ABI resolution means the SDK can work out an interface from a deployed contract rather than requiring you to hand it a full ABI.

And there is IPFS upload and download, with cross-platform support for the web and React Native named in the same list.

Read together, the list describes a specific product decision. The SDK is not only a wrapper over a chain's JSON-RPC, it is also a wallet layer, a node provider layer and an indexer layer, which is why it is useful to a product team and a heavier dependency for a developer who only wanted typed contract calls.

## React quick start with a client ID and a connect button

The React path is the shortest example in the documentation, and it shows the shape of the API.

The install is:

```bash
npm install thirdweb
```

and the application code creates a client, reads the active account and renders the connect component:

```typescript
import { createThirdwebClient } from "thirdweb";
import { ConnectButton, useActiveAccount } from "thirdweb/react";

const client = createThirdwebClient({
  clientId: "YOUR_CLIENT_ID",
});

function App() {
  const account = useActiveAccount();
  console.log("Connected as", account?.address);

  return <ConnectButton client={client} />;
}
```

Two things are worth noticing. The client is created once with a clientId and then passed around, which is the pattern a provider-based React library needs, and the account is read through a hook, useActiveAccount, rather than through a subscription you manage yourself. The optional chaining on account?.address reflects that no account is connected until the user acts.

For React Native there is one extra step the documentation spells out. You also need to install the @thirdweb-dev/react-native-adapter package and import it at app startup for polyfills, because a mobile JavaScript runtime does not provide the browser APIs the SDK expects.

## The backend path swaps a wallet for a server key

The backend example is where the SDK stops looking like a wallet library and starts looking like an execution service.

A backend client is created with a secretKey instead of a clientId, and a server wallet is obtained from Engine:

```typescript
import { createThirdwebClient, Engine } from "thirdweb";

const client = createThirdwebClient({
  secretKey: "YOUR_SECRET_KEY",
});

const wallet = Engine.serverWallet({
  client,
  address: "0x...",
});
```

The transaction is then described as data and handed to the engine to enqueue:

```typescript
const transaction = transfer({
  contract: getContract({
    client,
    address: "0x...", // token contract
    chain: defineChain(1),
  }),
  to: "0x...", // recipient
  amount: "0.01", // amount in tokens
});

await wallet.enqueueTransaction({
  transaction,
});
```

The differences from the browser path are the point. There is no ConnectButton and no user gesture, because there is no user. The amount is a string rather than a number, which is the usual choice for token amounts where precision matters. The chain is declared explicitly with defineChain. And the call is an enqueue, so the actual submission and the account abstraction machinery, the bundler and paymaster, live in the hosted Engine service.

That is also where the dependency on a hosted backend enters the design. The code is open, but the execution path for a server wallet runs through thirdweb's infrastructure.

## Five more packages, each with one job

Beyond the core package, the repository publishes five more, and each one is a thin typed client for a specific service.

The react-native-adapter holds the required polyfills and configuration for running the SDK in React Native applications. The wagmi-adapter is an integration layer for using thirdweb's in-app wallets with wagmi, which is the useful combination if your app already has wagmi for its external wallet connections and you want the in-app wallets to appear in the same connector list.

Then come the three type safe API wrappers. @thirdweb-dev/api is a TypeScript SDK for thirdweb's API, combining all of thirdweb products. @thirdweb-dev/engine is the SDK for Engine, the backend onchain executor service, and it is the package a server-side application reaches for. @thirdweb-dev/insight is the SDK for Insight, the multichain indexer service, which is where you would go for the indexed data rather than the raw chain.

Each installs with a single npm command of the same shape, for example:

```bash
npm install @thirdweb-dev/insight
```

The pattern is consistent on purpose. A team that uses one service installs one package, and a team that uses three installs three small clients rather than the entire core package, which is the main reason the core package is not the only sensible starting point.

## The monorepo, the dependency pins and the test environment

The engineering setup in the repository is what you would expect from an SDK that ships several packages on a shared release cadence.

It is a pnpm workspace with turbo running the tasks, and the root package.json requires Node 20 or newer and pnpm 9 or newer, with the package manager pinned to pnpm 9.11.0. Formatting and linting run through Biome, types through TypeScript 5.8.3, and releases are cut with changesets, which is what produces the independent version numbers you see across the packages, the core package on a 5.x line and the wagmi adapter on a 0.2.x line. There is a codecov configuration, an apps/ directory, a scripts/ directory, and both AGENTS.md and CLAUDE.md at the root.

The most interesting entry in the root package.json is the pnpm overrides block. It is a long list of forced version floors and ceilings for transitive dependencies, covering axios, ws across three major versions, undici, protobufjs, elliptic, tough-cookie, semver and more, plus a set of OpenZeppelin contract versions. Those are the kinds of overrides a web3 SDK needs, because a transitive dependency on an old ws or an old undici is a security problem in a package that signs and submits transactions.

There is also a .env.example, and its comment is instructive. A secret key is not required to build the packages, but the file says it will significantly increase test performance, because the key is used for unit tests that hit a real IPFS gateway. So the test suite can run without credentials, more slowly, and with the key it talks to the real thing.

## Open source code around a closed service

Two limitations belong in any honest assessment of this project.

The first is the licence question, and there is a discrepancy in the repository itself. The package metadata for the monorepo root declares the licence as MIT, while the repository's own licence classification records Apache-2.0. For the individual packages you install, the terms in the package metadata are what matter, so check the specific package before you rely on either figure, and read the LICENSE file rather than the badge.

The second is that the SDK is open source but the platform is not. The clientId and the secretKey are the entry point to thirdweb's hosted services, and the feature list names them: RPC, bundler, paymaster, indexer, and the Engine onchain executor. A team that wants to run everything itself, on its own RPC and its own bundler, is outside what these packages are designed to do, and the server wallet path in particular is a client for a hosted executor.

Two smaller things are also worth knowing. The React Native path needs a second package and an explicit import at startup, which is one more step to forget. And the documentation is not in this repository: the full documentation lives on the developer portal, with the README linking out to it, so a contributor working offline is working from the package READMEs and the wiki rather than a complete manual.

For security, the project asks that vulnerabilities not be reported in a public issue and gives an email address, security@thirdweb.com, for disclosure.

## Conclusion

thirdweb suits a team that wants one typed interface for contract calls, wallets and indexing rather than stitching those pieces together, and it is the wrong choice for a project that needs to run without a thirdweb account, because the client ID, the secret key and the hosted RPC, bundler, paymaster and indexer are all part of the normal path. Before adopting it, confirm your targets are on the chains thirdweb supports, and check the licence of the package you actually install, since the repository's package.json and its licence metadata do not agree.

## FAQ

### What packages does the thirdweb JavaScript repository publish?

The core thirdweb package for browser, Node and mobile apps, plus the react-native-adapter for React Native polyfills, the wagmi-adapter for using in-app wallets with wagmi, and three type safe API wrappers: @thirdweb-dev/api, @thirdweb-dev/engine for the onchain executor service and @thirdweb-dev/insight for the multichain indexer.

### How do I connect a wallet in a React app with thirdweb?

Create a client with createThirdwebClient and your clientId, render the ConnectButton from thirdweb/react, and read the connected account with the useActiveAccount hook. React Native applications additionally need the @thirdweb-dev/react-native-adapter package imported at app startup for polyfills.

### How does a backend send a transaction with thirdweb?

Create the client with a secretKey, get a server wallet from Engine.serverWallet, describe the transaction with transfer and a contract from getContract, and pass it to wallet.enqueueTransaction. Unlike the browser flow there is no user gesture, the amount is a string, and the chain is declared with defineChain.

### What does the thirdweb SDK need from thirdweb's own services?

A clientId for frontend use and a secretKey for backend use, and the feature list names the hosted infrastructure involved: RPC, bundler, paymaster and indexer, with Engine as the backend onchain executor. The code is open source but the services it talks to are not.

### How do I report a security issue in thirdweb?

The project asks that you do not open a public issue for a suspected vulnerability and that you disclose it by emailing security@thirdweb.com instead.

## Sources

- [License: Apache-2.0](https://github.com/thirdweb-dev/js/blob/main/LICENSE)
- [Project website](https://thirdweb.com)
- [README](https://github.com/thirdweb-dev/js/blob/main/README.md)
- [Releases](https://github.com/thirdweb-dev/js/releases)
- [thirdweb-dev/js on GitHub](https://github.com/thirdweb-dev/js)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/thirdweb-dev-js