---
title: What Is the SandGrain SDK?
description: "A plain-language intro to the SandGrain SDK: what it does, the Token, TrustBridge and CyberRock, and how hardware-backed device identity works."
---
[Skip to content](https://portal.sandgrain.eu/knowledge-base/what-is-the-sandgrain-sdk#main-content)
English
Show submenu for translations
.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Contact us](https://portal.sandgrain.eu/login)
[Contact us](https://portal.sandgrain.eu/login?hsLang=en)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Knowledge Base](https://portal.sandgrain.eu/knowledge-base?hsLang=en)
2. [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en)
3. [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
October 6, 2026
# What Is the SandGrain SDK?
**Who this is for:** Anyone opening the SandGrain SDK for the first time, embedded developers who will integrate it, and customers evaluating how it fits their product.
**What you'll get from this article:** A plain-language picture of what the SDK does, the pieces it works with, and where it fits before you install anything.
**The problem SandGrain solves:**
As connected devices multiply, three risks grow with them:
- **Counterfeiting and cloning**: copied devices impersonate genuine ones.
- **Unauthorized access**: devices that can't prove who they are let rogue nodes onto a network or cloud.
- **Firmware tampering**: modified firmware can subvert a device after it ships.
Software-only identity (keys in flash, shared secrets, copyable certificates) can be extracted and replicated. SandGrain moves the proof of identity into hardware: a device proves it physically holds its unique **Token** before it is trusted, before it joins the network, and before new firmware is authorized.
**How it works:**
Every SandGrain device carries a small cryptographic chip, the **Token**. A trusted verifier (the cloud) issues a random **Challenge Word**; the Token computes a **Response Word** from that challenge using a secret that never leaves the chip. A correct response proves the device is genuine without ever exposing the secret. This happens **mutually** (the device authenticates to the server and the server authenticates to the device), and the same mechanism extends to verifying firmware and authorizing installs.
The three pieces you'll work with
| Component | What it is | Who runs it |
| --- | --- | --- |
| **SandGrain Token** (crypto chip) | The hardware root of trust on each device. Holds the secret, computes Response Words, and is identified by a unique **TID** (Token ID). | Embedded in / attached to each device |
| **SandGrain SDK** | Portable C software with a layered architecture. Built in **Device mode** (runs on the unit holding the Token) or **Gateway mode** (relays and orchestrates authentication). A Python **Cloud SDK agent** provides the cloud-side counterpart. | Device, Gateway, and Cloud nodes |
| **TrustBridge platform** | The management system: a backend API, a web frontend, the Cloud SDK agent, plus a database and MQTT broker: all containerized. Enrolls devices, drives authentication, and manages the device lifecycle. It delegates challenge/response generation and verification to **CyberRock**, SandGrain's cloud authentication service. | Server / operations |
Together these take a device from unconfigured to fully enrolled, authenticated, and lifecycle-managed, on a single laptop for development, or spread across servers and edge hardware (including Raspberry Pi) for production.
What you can do with the SDK
- Prove a device's identity through a live, hardware-backed challenge–response exchange.
- Verify firmware integrity (the chip signs a SHA-256 hash of a firmware image).
- Gate firmware installation behind a server-approved exchange.
- Run all of this standalone for testing, or connected to the full TrustBridge platform.
Where to go next
- **New to the terminology?** Read [*Key Concepts & Glossary*](https://portal.sandgrain.eu/knowledge-base/key-concepts-glossary?hsLang=en) first.
- **Ready to plan your setup?** Read [*Choosing Your Setup Path*](https://portal.sandgrain.eu/knowledge-base/choosing-your-setup-path?hsLang=en) to pick the route that matches your goal and hardware.
- [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#main-content)
- [Quick Starter Guide](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#quick-starter-guide)
- [User Manual](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#user-manual)
- [Whitepaper](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#whitepaper)
- [Token Leaflet](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#token-leaflet)
- [Claim Token Procedure](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#claim-token-procedure)
- [Daisy Chain](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#daisy-chain)
- [Release Note](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#release-note)
- [Naming Convention](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#naming-convention)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#sandgrain-sdk)
- [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge)
- [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#main-content)
- [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration)
- [Daisy Chain and Attestation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#daisy-chain-and-attestation)
- [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#main-content)
- [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
[-1.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png "SandGrain_Logo_RGB_white-bijgesneden (1)-1")](https://portal.sandgrain.eu/?hsLang=en)
[mailto:email@email.com](mailto:email@email.com)
Copyright © 2026, sandgrain.eu