@palbase/admin

Palbase admin SDK — platform-operator tooling built on top of @palbase/server. Drives Studio's control plane and any first-party Palbase tooling that needs admin access to orgs, projects, plans, and per-project module admin surfaces.

Install

pnpm add @palbase/admin

Usage

import { createAdminClient } from '@palbase/admin';

const admin = createAdminClient({
  url: 'https://api.palbase.studio',
  apiKey: 'pk_live_xxx',           // Studio-issued public key
  serviceRole: 'sk_live_xxx',      // optional — RLS bypass
});

await admin.auth.signUp({ email, password });
const org = await admin.orgs.create({ name: 'Acme' });
const project = await admin.orgs(org.data!.id).projects.create({
  name: 'Shop',
  region: 'eu',
  plan: 'free',
});

// Per-project module admin (palauth users, docs collections, ...).
await admin.orgs(org.data!.id)
  .projects(project.data!.ref)
  .admin.auth.users.list();

// Service-role ServerClient for the customer project (RLS bypass on
// the customer's own tables, not on Palbase admin).
const server = await admin.orgs(org.data!.id)
  .projects(project.data!.ref)
  .server();
await server.data!.db.from('widgets').select('*');

Migrating from 0.x to 1.0

Constructor changes

| Old (0.x) | New (1.0) | | --- | --- | | palbaseProjectApiKey | apiKey | | palbaseProjectServiceRole | serviceRole | | palbaseProjectId | — removed (Kong resolves by api key) | | platform: { clientId, clientSecret } | — removed (no palauth M2M) | | — | moduleBaseURLs?: { auth?, docs?, … } (optional) |

Removed namespaces + surface

• admin.platform.* — platform-wide operations moved to Studio's tRPC router. hardDelete, listAllTenants, serviceRoleToken, impersonateUser are no longer on the SDK.
• admin.getPlatformToken() — test hook, palauth M2M no longer exists.
• PlatformTokenProvider + PlatformCredentials types — deleted.
• impersonateProjectServiceRole — replaced with mintProjectServiceRole (pure DB resolver).

Project-scope flow

admin.orgs(o).projects(ref).* no longer calls palauth for a bearer token. Instead the SDK reads the project's sk_live_xxx key from api_keys (RLS-scoped to org admins+) and attaches Kong's X-API-Key: sk_live_xxx + X-Project-Ref: <ref>. An optional user JWT rides along as Authorization: Bearer for RLS-honouring reads.

Code migration example

// Before (0.x)
const admin = createAdminClient({
  url: 'https://api.palbase.studio',
  palbaseProjectApiKey: 'pk_live_xxx',
  palbaseProjectServiceRole: 'sk_live_xxx',
  palbaseProjectId: 'prj_xxx',
  platform: { clientId: 'sa_xxx', clientSecret: 'xxx' },
});

// After (1.0)
const admin = createAdminClient({
  url: 'https://api.palbase.studio',
  apiKey: 'pk_live_xxx',
  serviceRole: 'sk_live_xxx', // optional
});

License

MIT