Naming
camelCase in TypeScript and snake_case in Python. Nothing else differs.
Async and sync
The TypeScript API isasync, and a Cloak vault may return promises. The Python API is synchronous, as its transport is, and a vault is synchronous too. A decorated Python coroutine function gets an async wrapper, and the blocking detection call runs on a worker thread so it does not stall the event loop.
Cryptography
Tokens and hashes are keyed HMAC-SHA-256 in both SDKs and produce identical strings for the same key, context, and value. TypeScript carries its own implementation so the SDK stays portable across Node, Workers, Deno, Bun, and browsers. It needs a secure random source only when it must generate a key: Node 19 or newer, or passguard.cloak.key. Python uses the standard library.
Neither SDK encrypts vaulted values. Encryption at rest belongs to a vault that persists.
Offsets
The control plane counts in UTF-16 code units, which is what a JavaScript string index is. TypeScript uses offsets as they are. Python indexes by code point, so it translates at the parse boundary. Entity offsets in Python are Python string positions, and a range that falls inside a surrogate pair is rejected rather than cut.Options
TypeScript passes plain objects. Python passes small frozen dataclasses (CloakOptions, ProtectOptions, MaskStrategy, and so on). Strategies given by name are strings in both.
Transport
TypeScript takes afetch override. Python takes a transport callable. Both default to the platform’s standard HTTP.