@firstlogicmetalab/server-sdk

Server-only helper for minting one-time VACT access tokens.

New to VACT? Create a free account at vact.online — ₹100 of calling credit to build with, no card required. Full guides and API reference: vact.online/docs.html.

const {VactServer} = require('@firstlogicmetalab/server-sdk');

const vact = new VactServer({
  appId: process.env.VACT_APP_ID,
  appSecret: process.env.VACT_APP_SECRET,
});

const token = await vact.createAccessToken({
  userId: authenticatedUser.id,
  // Optional: limit this session to specific callees.
  allowedCalleeIds: ['user_42'],
});

Configure a signed webhook once from a secure administration process, then save the returned signing secret in your backend secret manager:

const {signingSecret} = await vact.configureWebhook({
  url: 'https://api.example.com/webhooks/vact',
});

Verify the exact raw request body before parsing it:

const {verifyVactWebhook} = require('@firstlogicmetalab/server-sdk');
const event = verifyVactWebhook({
  rawBody: req.rawBody,
  headers: req.headers,
  signingSecret: process.env.VACT_WEBHOOK_SECRET,
});
// Deduplicate event.eventId, then send FCM/APNs/PushKit with your credentials.

Fulfil an authenticated user-deletion request from your backend. This pages until the user is fully erased, so a single call is enough:

const result = await vact.deleteUserData(authenticatedUser.id);
// result.truncated is true only if the deletion hit `maxRequests` (default 20)
// before finishing — call again if so.
if (result.truncated) await vact.deleteUserData(authenticatedUser.id);

This package is marked browser: false. Do not install it in a mobile, web, desktop or Flutter target. The App Secret is accepted only at runtime and is redacted from inspection and JSON serialization; the package ships no secret.

Client SDKs (web/React, React Native, Flutter), runnable examples and the full API reference: https://vact.online/docs.html · Sign up free: https://vact.online