Skip to main content
Install the public package:
Use Node.js 18 or later. The core resources are issuers, keys, attestations, verify, audit, and receipts. Do not assume every public API has a convenience method in this package; use the operation reference and client.request where appropriate.

​
Configure authentication

The API-key strategy is service, not apiKey. For a user operation use auth: { type: 'bearer', token } with a valid user token. tenantId does not authenticate or switch workspaces. Do not use tenant-only authentication.

​
Mint

Use an existing issuer and a key available for server-side signing. Use either encoded original bytes or structured schema and claims input.
Set all three environment variables before running the snippet. For structured input, replace payload_b64url with schema: "attestation" and claims: { subject: "demo-record" }; never send both modes. Public-key registration alone does not provision a signing private key.

​
Retries and response handling

The client adds an idempotency header to POST and PUT requests. A new method call generates a new key, so it is not a safe retry of an uncertain earlier write unless you retain and pass the same key. client.request accepts an idempotencyKey option. Automatic retries are limited to reads and supported attestation/receipt writes with an explicit key; arbitrary writes are not replayed simply because a key was provided. Inspect verification verdict and reasons. A resolved promise or HTTP 200 alone is not a valid-verification result. Match the installed package version with its type declarations; newly corrected source is not evidence that an older installed release contains the fixes. See the direct HTTP example for a dependency-independent integration and API reference for the current contract.