SDK authentication
Published release: SDK 0.1.3 is publicly available on npm. Package installation does not activate new backend features.
All active paid Business/Sole Trader plans—Basic, Professional and Enterprise—include API and SDK integration. Individual Creator (free), Pro and approved Scale configurations include API for their own websites and applications, subject to their separate approval and environment rules. Preview does not automatically grant LIVE API access. Individual sales remain approved digital products only, with Kordiva as Full Merchant of Record and its hosted checkout, tax, refund, dispute, reserve and payout controls.
Public npm downloads — @kordiva/sdk, @kordiva/checkout and @kordiva/react — require no credentials. Installation never grants Store API access; Store API keys are separate server credentials.
Store keys are server secrets, not Stripe publishable keys. The SDK sends Authorization: Bearer … to the configured API origin. Store and environment are determined by the matching server-side credential record. Prefix validation in the SDK catches mistakes; it does not replace backend authorization.
- Create the key through Settings → API Keys using an authorized OWNER/ADMIN account.
- Store it in a secret manager or protected server environment. Never use
NEXT_PUBLIC_,VITE_, HTML attributes, browser bundles or screenshots for secrets. - For rotation, create a replacement in the same store/environment, update backend configuration, verify a safe catalog read and then revoke the previous key.
- For a suspected leak, revoke promptly and review usage. Reconcile uncertain checkout attempts before retrying with a new key.
The current key has store/environment scope, not fine-grained operation scopes. Key management requires CMS identity and is deliberately absent from the merchant SDK. SDK errors omit raw bodies, keys and customer data; avoid logging the full client configuration yourself.
Existing key setup and verified capture