NitidaClientOptions

type NitidaClientOptions = {
  apiKey?: string;
  cdnBase?: string;
  endpoint: string;
  headers?: Record<string, string>;
  signingKey?: string;
  tenantCode: string;
  tenantId: number;
};

Defined in: packages/sdk/src/index.ts:88

Permissive constructor options for the root NitidaClient.

App code should NOT import this type directly — prefer the strict variants from the subpaths:

• WebClientOptions from @nitida/sdk/web (no apiKey)
• ServerClientOptions from @nitida/sdk/server (apiKey required)

This root type is the union both modes resolve to; the underlying class accepts both shapes so subpath wrappers can extend without duplication.

Properties

apiKey?

optional apiKey?: string;

Defined in: packages/sdk/src/index.ts:103

Bearer API key with the amk_rt_* prefix.

Server-only. Omit when constructing from @nitida/sdk/web — your BFF / route handler injects the bearer header in proxy mode.

---

cdnBase?

optional cdnBase?: string;

Defined in: packages/sdk/src/index.ts:118

Override the public CDN base. Defaults to https://8ok.uk.

---

endpoint

endpoint: string;

Defined in: packages/sdk/src/index.ts:96

Base URL of the nitida API (e.g. https://api.nitida.gofuture.space).

May be relative (e.g. /api/am) ONLY in browser contexts where the SDK resolves it against window.location.origin. Node/Bun consumers must always pass an absolute URL.

---

headers?

optional headers?: Record<string, string>;

Defined in: packages/sdk/src/index.ts:112

Extra headers merged into every request. The documented way for mobile/Expo clients to authenticate a BFF that gates on the Better Auth session: they can’t send cookies automatically, so they pass { Cookie: authClient.getCookie() } here (see Better Auth Expo docs, “Making Authenticated Requests to Your Server”). Web/server consumers omit this — browsers attach the same-origin cookie and servers pass apiKey.

---

signingKey?

optional signingKey?: string;

Defined in: packages/sdk/src/index.ts:143

Tenant’s HMAC signing key for transform URLs (Phase 3). Required only when calling aq.transform(asset, opts, { sign: true }).

32 random bytes, generated server-side on tenant creation.

Where you get it: the response to your project’s creation, once. POST /admin/projects returns signingKey next to the three API keys, and the console shows it in the same panel. It is shown there and nowhere else — save it with the keys.

Never saw one? Projects created before 2026-08-23 were not handed it, and no endpoint shows you the current one. If you have not signed any URLs yet — true of every project that has not shipped private assets — ask for a rotation: with nothing in flight it invalidates nothing and is free. If you already have signed URLs circulating, ask for the current key instead.

Either way it is one request to the platform operator: POST /admin/projects/:code/rotate-signing-key needs a SYSTEM-scope credential, and your own admin key answers 403 SYSTEM_KEY_REQUIRED.

Keep it server-side only — do not ship in NEXT_PUBLIC_* env vars. Sign URLs from a BFF route handler, or pre-sign at build time.

---

tenantCode

tenantCode: string;

Defined in: packages/sdk/src/index.ts:114

Tenant code — sent as X-Tenant-Code (log-only). Authoritative scope is the key’s metadata.tenantId.

---

tenantId

tenantId: number;

Defined in: packages/sdk/src/index.ts:116

Numeric tenant id — used to build tenant-prefixed CDN URLs <cdn>/<tenantId b36>/v/<sha>-<preset>.<ext>.