izini-mobile-sdk

The official Izini SDK for React Native and Expo: load your project's consent topics, check consent before running a tracker, and record the user's choices with Izini.

Install

npm install izini-mobile-sdk @react-native-async-storage/async-storage react-native-safe-area-context
# Expo
npx expo install izini-mobile-sdk @react-native-async-storage/async-storage react-native-safe-area-context

Use

import { Izini } from 'izini-mobile-sdk';

// Once, at start-up. projectCode: Dashboard > Project > Code (not the project id).
Izini.initialize({
  projectCode: 'YOUR_PROJECT_CODE',
  userId: currentUser?.id, // optional: your own user id; otherwise a per-device id
  userIdKey: IZINI_USER_ID_KEY, // optional (1.3+): send a keyed hash of userId instead of the id
  bundleId: 'com.yourcompany.app', // as registered under Installation & SDKs
  debugMode: __DEV__,
});

// Before running a tracker (topic keys come from Dashboard > Consent topics)
if (Izini.hasConsent('analytics')) {
  Analytics.start();
}

// When the user decides
await Izini.updateConsent('analytics', true);  // GRANTED
await Izini.updateConsent('analytics', false); // REVOKED

// React to changes
const unsubscribe = Izini.onConsentUpdated((status) => console.log(status));

initialize returns at once and syncs in the background: it loads the project's topics and this user's earlier choices. Every updateConsent is stored on the device and recorded with Izini, which notifies your backend through your project's consent.updated webhooks.

Data rights: Izini.requestDataExport() and Izini.requestErasure() file an access or erasure request for the current user.

Configuration

| Option | Default | | |---|---|---| | projectCode | (required) | Your project's code | | userId | per-device id | Your own id for the signed-in user. Not an email, phone or card number: Izini refuses those. | | userIdKey | none | Secret key: when set, Izini receives h1_ + HMAC-SHA256(userIdKey, userId) instead of the id. Same key in every app and your backend. | | bundleId | none | Your bundle id (iOS) or application id (Android), as registered. Sent as X-Bundle-Id; required when the project only accepts registered apps | | apiBaseUrl | https://app.izini.ng/api/v1 | Override for staging | | debugMode | false | Log SDK activity |

Keeping user ids from Izini (userIdKey, SDK 1.3+)

Set userIdKey and the SDK sends h1_ + HMAC-SHA256(userIdKey, userId) instead of your user id, so Izini never receives it. Use the same key in every app and in your backend, so the same person always gets the same id. Keep the key in your own configuration: never send it to Izini.

When your backend sends ids to Izini itself (for example customer_id to the DSAR gateway), hash them the same way:

// Node.js
const crypto = require('crypto');
const izId = 'h1_' + crypto.createHmac('sha256', process.env.IZINI_USER_ID_KEY).update(userId.trim()).digest('hex');

# Python
import hmac, hashlib, os
iz_id = 'h1_' + hmac.new(os.environ['IZINI_USER_ID_KEY'].encode(), user_id.strip().encode(), hashlib.sha256).hexdigest()

// PHP
$izId = 'h1_' . hash_hmac('sha256', trim($userId), getenv('IZINI_USER_ID_KEY'));

In the dashboard, Hashed id (consent register) and Hash with my key (DSAR log) compute the same value in your browser.

Documentation

• API reference: the consent endpoints this SDK calls, their fields and errors, and the consent.updated webhook.
• Keep consent records in your own database: receive each choice your app records, signed, on your server.
• In the Izini dashboard, Administration > Developers has your project code and links to everything else.

Questions: [email protected].

Changelog

1.3.1: documentation only. Links to the public API reference; the previous link pointed at a private repository.

1.3.0: new userIdKey option: the SDK sends a keyed hash of userId instead of the id (hashUserId is exported for your own use). Izini refuses emails, phone numbers and card numbers as userId.

1.2.0: new bundleId option, sent with every request so Izini can check it against the project's registered apps.

1.1.0: uses https://app.izini.ng/api/v1 (api.izini.ng, used by 1.0.x, no longer exists, so 1.0.x records nothing); topics come from the project's consent topics; the user's earlier choices load on start-up; withdrawals are sent as REVOKED; DSAR requests send the project id. Removed the module entry, which pointed at a file that was never built.