@sendity/[email protected]

Framework-agnostic Sendity Custom Element for browser authentication challenges. Version 0.2.0 is the new incompatible Custom Element line; existing production integrations that need the 0.1 attribute/visual contract should stay pinned to 0.1.x.

Install

npm install @sendity/[email protected]

Import the package once in your frontend entrypoint:

import '@sendity/client'

Then render:

<sendity-auth public-key="pk_live_..."></sendity-auth>

Attributes

| Attribute | Required | Description | |---|---:|---| | public-key | yes | Public Sendity application key. | | server-url | no | API root. Defaults to https://sendity.io/api. | | lang | no | Supported locale such as en, de, fr, ar, he. | | transport | no | auto, polling, or push. Defaults to auto. | | authenticated-event-delay-ms | no | Delay before handoff/authenticated events. Defaults to 2000. | | variant="no-card" / no-card | no | Host-layout mode without the standalone card chrome. |

Removed 0.1 attributes such as verify-urls, session-handoff-url, footer, hide-footer, authenticity-details-url, and dkim-details-url are intentionally not part of the 0.2 public contract. Verification destinations and session_handoff_url are server-owned response data.

Server response contract

The create/status/authenticated responses may provide:

• verify_urls / verifyUrls or verification_endpoints for channel destinations.
• broadcasting metadata for Reverb/Pusher-compatible realtime transport.
• session_handoff_url / sessionHandoffUrl for host-app session handoff. The 0.2 client only posts handoff tokens to same-origin URLs by default.

Events

The element emits bubbling/composed CustomEvents:

• sendity:ready
• sendity:challenge-created
• sendity:state-change
• sendity:verification-rejected
• sendity:session-authenticated
• sendity:authenticated
• sendity:error

sendity:authenticated includes signedResult only when no same-origin session_handoff_url is used. After a successful handoff the public detail omits the signed token and includes handoff: "completed".

Assets and styling

0.2.0 inlines the Tailwind layer into the Shadow DOM at runtime from the package bundle, so consumers do not need to host a hard-coded /vendor/sendity-client/tailwind.css path. Component-specific styles are also scoped inside the Shadow DOM.