Crossmint REST SDK for JavaScript and TypeScript

A typed client for the Crossmint REST API. Supports Node.js 18+ and browsers with native Fetch, with ESM and CommonJS exports and no runtime dependencies.

Install

npm install @crossmint/rest-js

Create a client

import { createCrossmintSdk } from "@crossmint/rest-js";

const crossmint = createCrossmintSdk({
    environment: "staging",
    apiKey: process.env.CROSSMINT_API_KEY,
});

const { data: wallet } = await crossmint.wallets.create({
    body: { chainType: "evm", type: "mpc" },
    throwOnError: true,
});

The default environment is staging. Set environment: "production" to use the production API. The client routes each operation to its API host automatically, including Vault operations. Endpoints available only in staging reject requests in production.

To call through your own backend proxy or a local API, set baseUrl to an absolute URL. It replaces the API host and its /api path for every operation except Vault operations:

const crossmint = createCrossmintSdk({ baseUrl: "https://your-app.example/api/crossmint" });

Vault operations (payment method creation) send raw card and bank details, and only the Vault host tokenizes them. They stay on the Vault host when you set baseUrl. To move them too, set vaultBaseUrl. A server that receives these requests receives the raw card data, so it comes into your PCI DSS scope.

Keep server API keys on your server. In browsers, use a client API key with the appropriate scopes and supply userJwt when the endpoint requires user authentication. For order endpoints that accept an order client secret, use clientSecret. Each request uses a complete authentication alternative declared by the API; explicitly supplied request headers take precedence.

Requests and responses

Methods are grouped by resource, such as crossmint.wallets.create(...) and crossmint.orders.get(...). Request options keep body, path, query, and headers separate. Pass an AbortSignal through signal to cancel a request, or provide a custom Fetch implementation when creating the client.

const { data, error, response } = await crossmint.orders.get({
    path: { orderId: "your-order-id" },
});

if (error !== undefined) {
    console.error(response?.status, error);
} else {
    console.log(data);
}

HTTP failures return error by default. With throwOnError: true, the client throws the error instead. Network failures also return error unless throwOnError is enabled. Returned errors are not necessarily JavaScript Error instances.

Some APIs expose multiple versions explicitly, for example crossmint.paymentMethods.v20260916.create(...) and crossmint.paymentMethods.unstable.create(...). Use the version documented for your integration; unstable APIs may change.

Streaming

Streaming methods return an async iterator:

const abortController = new AbortController();
const { stream } = await crossmint.agentCheckouts.messages.stream({
    path: { id: "your-checkout-id" },
    signal: abortController.signal,
});

for await (const event of stream) {
    console.log(event);
}

React Query

Use SDK methods in query functions and mutations. Include the environment and project or user identity in your cache scope, so requests from different clients do not share cached results. Never put API keys or tokens in query keys.

import { useQuery } from "@tanstack/react-query";

const walletQuery = useQuery({
    queryKey: ["crossmint", cacheScope, "wallet", walletLocator],
    queryFn: async ({ signal }) => {
        const { data } = await crossmint.wallets.get({
            path: { walletLocator },
            signal,
            throwOnError: true,
        });
        return data;
    },
});

React Query is installed separately. The SDK does not depend on React.

Compatibility

The SDK is generated from Crossmint's public OpenAPI specification. Its endpoint coverage and request and response types follow that specification. TypeScript types do not perform runtime response validation.

The package supports bundlers that consume ESM and sideEffects: false. Completely unused imports can be removed; creating a resource client currently includes the full operation registry. Per-resource bundle splitting is not provided. React Native and other Fetch-compatible runtimes have not been validated.

See the API reference for endpoint behavior, permissions, and API limits.

Licensed under Apache 2.0. See THIRD_PARTY_NOTICES for the bundled Hey API transport's MIT license.