Stream Connect JavaScript SDK

Version

0.8.4

Credential validations that outlive a single progress stream now keep reporting live. A stream connection is capped at about ten minutes server-side; the SDK reattaches to the running validation instead of showing "Still working on it" and going quiet, so members on slow carriers or long MFA waits see the flow finish rather than having to reload.

0.8.3

Fix: carriers whose credential form asks for a Date of Birth (Medical Mutual, SimplePay Health) could not be connected at all. The value was discarded before submit, so the server rejected the enrollment as missing a required field and no input format worked. Regression introduced in 0.8.0. Date fields now render as a native date input.

0.8.2

Patient Access API (OAuth) connections finish with a self-dismissing "Connected" toast and return the member to the carrier picker instead of dead-ending on a full-page end widget. Tapping an already-connected carrier opens a status view first. Fix: 2FA-required carriers reach the verification-method picker rather than a false "Connected". StreamConnect() refuses to mount on insecure (plain-HTTP) host pages.

0.8.1

Handle expired connectAccessToken cleanly. Long-lived pages no longer surface the misleading 422 when the ~60-minute server-side TTL elapses; integrations opt into transparent refresh via a new server-side endpoint hook, or a clean expiry callback as a fallback. See the Refreshing an expired token integration guide.

0.8.0

Polished default appearance, React 19 + TypeScript, real-time credential-validation streaming, and a substantial dependency cleanup. The init() contract is backward-compatible: every option supported in 0.7.7 keeps working, including the custom render props (renderChoosePayer, renderPayerForm, renderEndWidget).

Philosophy

This SDK embeds the EasyEnrollment platform into the host application's own pages. From 0.8.0 onward, the SDK ships with a polished default appearance so it looks good out of the box on any host page, with no required CSS work. Branding is configurable via theme.primaryColor, and the existing custom render props remain available for integrators who want full control over a particular step.

Change Log

Latest highlights below. The full per-version changelog lives in CHANGELOG.md.

0.8.4 highlights

• A validation that outlives one progress-stream connection keeps streaming. The server caps a single SSE connection at roughly ten minutes, but the validation behind it can run far longer: the post-MFA claims pull is usually what takes the time. The SDK now re-fetches the policy holder for a fresh stream token and resubscribes, up to ten times, covering the validation's whole observable lifetime.
• Members who used to dead-end on "Still working on it" until they reloaded the page now watch the connection complete. pending_async is still there, but only for when reattach genuinely can't proceed.
• Dropped connections take the same path behind a backoff, so an SSE blip no longer ends a validation's live reporting.
• Requires the policy-holder GET to serve task_id + task_token (stream #15091). Against an older backend the SDK falls back to the previous pending_async behavior rather than failing.

0.8.3 highlights

• Fix: a carrier whose credential form includes a Date of Birth field — Medical Mutual, SimplePay Health — could not be connected. Whatever the member typed was dropped before the request left the browser, so the server rejected the enrollment as missing a required field and returned a validation error no input format could clear. Introduced in 0.8.0 by a spread-order change; ten weeks in the field.
• Date fields ({"type": "string", "format": "date"} in the carrier schema) now render as a native date input rather than a bare text box, so the submitted value is always the ISO YYYY-MM-DD the backend expects.
• The React Native hook (stream-connect-sdk-hook) was never affected.

0.8.2 highlights

• Patient Access API (OAuth) connections end with a self-dismissing "Connected" toast in the floating panel and return the member to the carrier picker, instead of dead-ending on a full-page end widget.
• Tapping an already-connected carrier opens a status view (status, last-synced, masked username, claim-sync summary) with credentials gated behind an explicit "Update sign-in info" / "Reconnect".
• Fix: 2FA-required carriers reach the verification-method picker rather than a false "Connected" — the realtime flow keys off a live validation task rather than realTimeVerification.
• StreamConnect() refuses to mount on insecure (plain-HTTP) host pages; localhost / 127.0.0.1 / [::1] still work for local dev.

0.8.1 highlights

• Handle expired connectAccessToken (the ~60-minute server-side TTL) without the misleading 422. Opt in to transparent recovery by wiring connectAccessTokenRefreshFn against a server-side refresh endpoint (Flask + Express snippets in docs), or use the onConnectAccessTokenExpired callback (and tpastream-connect-token-expired window event) to render a "session expired" UI as a fallback. Parallel-request stampede guarded; notifications coalesced to one per expiry cycle. Integrations that wire nothing see a cleaner error message but still need a page reload to recover.

0.8.0 highlights

• Polished default appearance; no host-page CSS required.
• theme.primaryColor init option recolors buttons, links, focus rings, and progress bars.
• React 19, full TypeScript port; substantial dependency cleanup (Bootstrap, jQuery, FontAwesome, react-jsonschema-form, react-popup, react-select, query-string and others removed).
• Non-blocking credential validation: SSE-driven progress in a hero element + corner panel, parallel validations, inline 2FA, no modal/full-screen takeover.
• enableInterop -> enablePatientAccessAPI rename (legacy alias kept indefinitely).
• realtimeTimeout and maxRetries accepted but @deprecated no-ops (knobs for the deleted polling loop).
• fixCredentials accepted but @deprecated and ignored; member-portal mode is derived from connectAccessToken presence.
• Backward-compatible with 0.7.7 at the init() call site. See docs/migration-0.7-to-0.8.md for the upgrade story.

Example Page

Here!

Package

Here!

Additional Documentation

Start with docs/ for a full table of contents. Common entry points:

• Quickstart
• Client Usage: full init option reference
• Migrating from 0.7.x to 0.8
• SDK Flow
• Two-Factor Authentication
• Fix Credentials
• Patient Access API (Interop)
• Theme
• Connect Access Token
• Errors
• FAQ

The separate React Native hook package ([email protected]) is soft-deprecated in favor of embedding the main SDK in a WebView. The published 0.6.2 tarball on npm keeps working for existing integrations; we're not republishing because the hook's source imports from assets/shared/ which the 0.8 rewrite deleted, and the right path for new integrations is the WebView pattern anyway. See sdk-hook/docs/README.md for the deprecation notice and recommended pattern; Quickstart > Mobile has end-to-end examples.

Development Commands

npm install                # install dependencies
npm run build              # build sdk.js (production bundle)
npm run format             # biome check --write across assets/
npm test                   # lint + typecheck (runs both below)
npm run test:lint          # biome check assets/
npm run test:types         # tsc --noEmit

Bump the version in package.json with each release and update CHANGELOG.md.

Local sandbox

A dev-only /sdk-test route is wired into the stream webapp for iterating on the SDK against a real backend. It mints a fresh connect access token server-side per request and embeds the SDK with a known-good fixture. See stream/views.py::sdk_test in the stream repo for the implementation, and stream/static/js/sdk-test.js for the bundled SDK artifact it serves.