Public package: The
@truthlock/sdk package is available on the public
npm registry. No special configuration required.Installation
Quick Start
quickstart.ts
Revoke an attestation
Permanently invalidate an attestation. Once revoked, any verification check returnsREVOKED. This action cannot be undone — if you need to issue an updated credential instead, use supersede.
revoke.ts
Supersede an attestation
Replace an existing attestation with an updated version. The original is marked asSUPERSEDED and linked to the new one, creating an auditable version chain.
supersede.ts
Both the original and new attestation remain in the transparency log. Verifiers can trace the full chain using the
superseded_by_attestation_id field on the original.Configuration
Idempotency keys
The SDK generates anIdempotency-Key header automatically on every write operation (mint, revoke, supersede), making retries safe by default. If a request fails and is retried, the server returns the original response instead of performing the action twice.
When multiple applications share the same tenant, set idempotencyPrefix to namespace the auto-generated keys and prevent collisions:
billing-svc_<uuid>, while onboarding produces onboarding-svc_<uuid> — so concurrent requests from different services never conflict.
Idempotency keys expire after 24 hours. If you omit
idempotencyPrefix, keys are generated without a prefix and are still unique per request.Authentication
Three authentication methods are supported. API Key is recommended for server-side applications.API Key (recommended)
Bearer Token (session-based)
Service Key (machine-to-machine)
Retry behavior
WhenmaxRetries is set (default: 3), the SDK automatically retries failed requests using exponential backoff with jitter.
What gets retried
The SDK retries a request when all of the following are true:- The HTTP status code is retryable:
408,429,500,502,503, or504 - The retry count has not exceeded
maxRetries - The request has not been aborted via an
AbortController
400, 401, 403, 404, or 409 are not retried.
Backoff schedule
The delay doubles on each attempt, capped at 2 seconds. Jitter adds ±20% randomization.
When the API returns a
429 with a Retry-After header, the SDK waits the server-specified duration instead.
Disabling retries
The SDK generates idempotency keys automatically for write operations, so retries for mint and revoke calls are safe. You can set a custom prefix with the
idempotencyPrefix option.Error handling
API methods
All methods return typed Promises.Issuers
client.issuers.create(data)client.issuers.get(id)client.issuers.list()client.issuers.trust(id)client.issuers.suspend(id)client.issuers.revoke(id, reason)
Keys
client.keys.register(issuerId, data)client.keys.list(issuerId)client.keys.rotate(kid, data)client.keys.reportCompromise(kid)
Attestations
client.attestations.mint(data)client.attestations.get(id)client.attestations.list()client.attestations.revoke(id, data)client.attestations.supersede(id, data)— see supersede APIclient.attestations.getProofBundle(id)
Receipts
client.receipts.mint(data)client.receipts.get(id)client.receipts.list(filter?)client.receipts.revoke(id, data?)client.receipts.listTypes()client.receipts.getType(name)client.receipts.createType(data)client.receipts.getProofBundle(id)— see proof bundle APIclient.receipts.verify(receiptId)— see verify APIclient.receipts.search(query)— see search APIclient.receipts.export(req)— see export APIclient.receipts.getExport(exportId)client.receipts.listExports()client.receipts.redact(id)— see redact API
Verification
client.verify.verifyOnline(data)
API Keys
client.apiKeys.list()client.apiKeys.create(data)client.apiKeys.revoke(id)
Audit
client.audit.query(params)client.audit.export(data)
Governance
client.governance.listRequests()client.governance.createRequest(data)client.governance.approveRequest(id)client.governance.executeRequest(id)
Governance workflows
Manage formal issuer actions — suspend, revoke, reinstate, and change trust tier — through a multi-party approval workflow. Create a request, collect approvals from authorized reviewers, then execute.governance.ts
Audit queries and exports
Query audit events with filters and export logs for compliance reporting. Useclient.audit.query() to search events and client.audit.export() to start an asynchronous export job.
audit.ts
Receipt operations
Mint, verify, search, export, and redact cryptographically signed receipts. See the receipts guide for an overview of receipt types and the full lifecycle.receipts.ts

