Skip to main content

INTEGRATIONS · SDKs

JavaScript SDK and CLI

Install the 1.0.0 release in trusted Node.js tooling or automation. The SDK is not intended for browser-side credentials.

Before you install

The current client artifacts are published as versioned GitHub Release assets in private repositories. Sign in with a GitHub account that has repository read access before opening a release. An anonymous 404 is expected for these private links; it does not mean the release is missing. The SDKs are not published to npm or RubyGems, and the Action is not published to the GitHub Marketplace.

If you need repository access, email AppsCert support with the artifact and version you need and the GitHub account that should receive read access. Do not include API keys, OIDC assertions, workload tokens, passwords, private keys or certificate files in the request.

For API v1, obtain an authorized workload token through managed workload onboarding. Never embed it in browser or mobile code. The CLI also has a separate legacy API-key mode; see credential choices.

JavaScript SDK and CLI · 1.0.0

Open the private JavaScript release. Download appscert-sdk-1.0.0.tgz, appscert-1.0.0.tgz, and SHA256SUMS from its assets. Authenticate to the private release first. Verify the checksums, then install both tarballs from your existing consumer project; the block stops before npm install if any checksum fails and does not publish to npm:

set -euo pipefail
gh auth status
PACK_DIR="$(mktemp -d)"
gh release download 1.0.0 --repo jojoyaco/appscert-client-js --pattern 'appscert-sdk-1.0.0.tgz' --pattern 'appscert-1.0.0.tgz' --pattern SHA256SUMS --dir "$PACK_DIR"

verify_sha256sums() {
  local dir="$1"
  if command -v sha256sum >/dev/null 2>&1; then
    (cd "$dir" && sha256sum -c SHA256SUMS)
  elif command -v shasum >/dev/null 2>&1; then
    (cd "$dir" && shasum -a 256 -c SHA256SUMS)
  else
    echo "Need sha256sum or shasum to verify release assets" >&2
    return 1
  fi
}

verify_sha256sums "$PACK_DIR"
npm install --no-save \
  "$PACK_DIR/appscert-sdk-1.0.0.tgz" \
  "$PACK_DIR/appscert-1.0.0.tgz"

The v1 client needs an already-authorized workload token; the CLI also retains its separate legacy API-key mode.

c3209c7