@ductape/client

Frontend client SDK for Ductape: real-time database, storage, actions, brokers, and more.

Installation

npm install @ductape/client

Usage

With publishable key (frontend / BFF)

When using a publishable key, all requests go through the Ductape proxy. You must:

1. Include session in every request. The options object for each call (e.g. storage.upload, databases.query, actions.run) must contain a session property set to a session token issued by your backend. The proxy rejects requests without a valid session.

   const sessionToken = getSessionFromYourBackend(); // e.g. after user login
   
   await ductape.storage.upload({
     storage: 'gcp-storage',
     fileName: 'path/file.txt',
     data: blob,
     mimeType: 'text/plain',
     session: sessionToken, // required when using publishable key
   });
   
   await ductape.databases.query({
     database: 'mongo-db',
     table: 'orders',
     limit: 10,
     session: sessionToken,
   });

2. Do not call session methods from the client. When using a publishable key, ductape.sessions.start, sessions.verify, sessions.refresh, sessions.revoke, and other session APIs are disabled and will throw. Sessions can only be started and managed on the backend. Your backend issues a session token and returns it to the frontend; the frontend only passes that token in the session field of each request.

With access key (server-only)

On the server, use an access key instead of a publishable key. No session is required in params; session APIs are available for starting and managing sessions.

Documentation

See the main Ductape documentation for the full security model and session requirements (frontend access key strategies, publishable key, and session-in-params).