@yashodeep/vardox-sdk

Thin TypeScript client for Vardox document verification via GET /api/v1/verify. Integrators only need your deployment URL and an API key — no RPC URLs, contract addresses, or chain configuration.

Requirements

• Node.js 18+ (global fetch and Web Crypto crypto.subtle)

Install

npm install @yashodeep/vardox-sdk

Usage

Create an API key in the Vardox dashboard (organization owner): POST /api/organizations/{organizationId}/api-keys while authenticated. The plaintext key is shown once (vdox_...).

Run verification only on your server. Do not embed API keys in mobile apps or public websites.

import { VardoxClient } from "@yashodeep/vardox-sdk";

const client = new VardoxClient({
  baseUrl: process.env.VARDOX_BASE_URL!, // e.g. https://your-vardox-host.com
  apiKey: process.env.VARDOX_API_KEY!,
});

// By SHA-256 hex of the file (same as in-app verifier)
const result = await client.verifyByHash(
  "a1b2c3..." // 64 hex chars
);

// Or hash bytes and verify in one step
const file = await fs.promises.readFile("certificate.pdf");
const fromFile = await client.verifyFileBytes(file);

console.log(fromFile.document.name, fromFile.verifiedOnChain);

Errors

Failed HTTP responses throw VardoxApiError with status and parsed body.

Security

• Treat API keys like passwords: environment variables on the server, rotation if leaked.
• The SDK does not implement chain calls; your Vardox server performs registry lookup and optional on-chain verification.

Publishing (maintainers)

Releases are published from CI when you push a tag matching sdk-v* (see .github/workflows/publish-sdk.yml).

1. Bump version in packages/sdk/package.json.
2. Commit and tag: git tag sdk-v0.1.0 && git push origin sdk-v0.1.0
3. Configure the NPM_TOKEN secret in the GitHub repository (automation token with publish scope for your npm user scope, e.g. @yashodeep).