# NitidaClientOptions

```ts
type NitidaClientOptions = {
  apiKey?: string;
  cdnBase?: string;
  endpoint: string;
  headers?: Record<string, string>;
  signingKey?: string;
  tenantCode: string;
  tenantId: number;
};
```

Defined in: packages/sdk/src/index.ts:88

Permissive constructor options for the root `NitidaClient`.

App code should NOT import this type directly — prefer the strict
variants from the subpaths:

  - `WebClientOptions`    from `@nitida/sdk/web`     (no `apiKey`)
  - `ServerClientOptions` from `@nitida/sdk/server`  (`apiKey` required)

This root type is the union both modes resolve to; the underlying class
accepts both shapes so subpath wrappers can extend without duplication.

## Properties

### apiKey?

```ts
optional apiKey?: string;
```

Defined in: packages/sdk/src/index.ts:103

Bearer API key with the `amk_rt_*` prefix.

**Server-only.** Omit when constructing from `@nitida/sdk/web` —
your BFF / route handler injects the bearer header in proxy mode.

***

### cdnBase?

```ts
optional cdnBase?: string;
```

Defined in: packages/sdk/src/index.ts:118

Override the public CDN base. Defaults to `https://8ok.uk`.

***

### endpoint

```ts
endpoint: string;
```

Defined in: packages/sdk/src/index.ts:96

Base URL of the nitida API (e.g. `https://api.nitida.gofuture.space`).

May be relative (e.g. `/api/am`) ONLY in browser contexts where the
SDK resolves it against `window.location.origin`. Node/Bun consumers
must always pass an absolute URL.

***

### headers?

```ts
optional headers?: Record<string, string>;
```

Defined in: packages/sdk/src/index.ts:112

Extra headers merged into every request. The documented way for
mobile/Expo clients to authenticate a BFF that gates on the Better Auth
session: they can't send cookies automatically, so they pass
`{ Cookie: authClient.getCookie() }` here (see Better Auth Expo docs,
"Making Authenticated Requests to Your Server"). Web/server consumers omit
this — browsers attach the same-origin cookie and servers pass `apiKey`.

***

### signingKey?

```ts
optional signingKey?: string;
```

Defined in: packages/sdk/src/index.ts:143

Tenant's HMAC signing key for transform URLs (Phase 3). Required
only when calling `aq.transform(asset, opts, { sign: true })`.

32 random bytes, generated server-side on tenant creation.

**Where you get it: the response to your project's creation, once.**
`POST /admin/projects` returns `signingKey` next to the three API keys,
and the console shows it in the same panel. It is shown there and nowhere
else — save it with the keys.

**Never saw one?** Projects created before 2026-08-23 were not handed it,
and no endpoint shows you the current one. If you have not signed any URLs
yet — true of every project that has not shipped private assets — ask for
a rotation: with nothing in flight it invalidates nothing and is free. If
you already have signed URLs circulating, ask for the current key instead.

Either way it is one request to the platform operator:
`POST /admin/projects/:code/rotate-signing-key` needs a SYSTEM-scope
credential, and your own admin key answers `403 SYSTEM_KEY_REQUIRED`.

**Keep it server-side only** — do not ship in `NEXT_PUBLIC_*` env vars.
Sign URLs from a BFF route handler, or pre-sign at build time.

***

### tenantCode

```ts
tenantCode: string;
```

Defined in: packages/sdk/src/index.ts:114

Tenant code — sent as `X-Tenant-Code` (log-only). Authoritative scope is the key's metadata.tenantId.

***

### tenantId

```ts
tenantId: number;
```

Defined in: packages/sdk/src/index.ts:116

Numeric tenant id — used to build tenant-prefixed CDN URLs `<cdn>/<tenantId b36>/v/<sha>-<preset>.<ext>`.