@scansocket/client

import { ScanSocketClient, ScanSocketVisitorClient } from "@scansocket/client";

const client = new ScanSocketClient(
  "https://scansocket.xyz",
  process.env.SCANSOCKET_API_TOKEN!,
);
const redirect = await client.createRedirect({
  url: "https://example.com/welcome",
  visitorMessaging: "public", // Explicit browser-to-owner opt-in
});

console.log(redirect.shortUrl, redirect.qrCode); // qrCode is a base64 data URL

const unsubscribe = client.subscribe(redirect, (event) => {
  switch (event.type) {
    case "connected":
      console.log("Visitor connected", event.data.connectionId);
      void client.sendMessage(redirect, event.data.connectionId, { greeting: "Welcome!" });
      break;
    case "message":
      console.log("Visitor sent", event.data.data);
      break;
    case "disconnected":
      console.log("Visitor disconnected", event.data.connectionId);
  }
});

// In the destination page; valid only for visitorMessaging: "public":
const visitor = new ScanSocketVisitorClient("https://scansocket.xyz");
await visitor.sendMessage(connectionId, { answer: "B" });

Each visit adds scanSocketConnectionId to the destination URL and preserves its other query parameters and fragment. The owner receives the same value as connectionId in the connected event and can pass it to sendMessage.

Visitor-to-owner messaging is disabled by default. Choose "authenticated" when your application backend will validate the visitor and call client.sendVisitorMessage(connectionId, data) with its owner token. Choose "public" only to allow browser code to send with the connection ID capability. Never expose the owner token to a browser.

Connection IDs grant access to owner messages and, in public mode, allow visitor messages. Do not log or publish them, and never use them as user identity or authentication.

Opening the visitor SSE stream establishes presence. A disconnect is emitted only when all streams for the connection have been absent for 10 seconds; reconnecting within that grace period does not flap presence. A later return emits a new connected event. Visitor messages are limited to 16 KB of serialized JSON and 30 messages per connection per 10 seconds.

Use client.events(redirect) as an async iterator when backpressure matters. The client uses the JSON Lines stream, carries the last event ID across normal reconnects, and accepts an AbortSignal. Call the function returned by subscribe when the consumer shuts down.

Generate and revoke API tokens from the ScanSocket account page. Keep tokens server-side; each token grants access only to its owner's redirects.

See the deployment's /docs page for the full integration guide and API reference.