SDK
@prebit/sdk — the official Node client.
@prebit/sdk is the official Node SDK: a typed API client, OAuth/PKCE
helpers, webhook signature verification, and the manifest/review-scan
tooling prebit-cli runs before every publish.
npm install @prebit/sdkimport { PrebitPartnerClient } from "@prebit/sdk";
const client = new PrebitPartnerClient({
baseUrl: "https://admin.prebit.in",
accessToken: process.env.PREBIT_ACCESS_TOKEN!,
});
const { store } = await client.getStore();
await client.createProduct({ name: "Coffee Mug", price: 499 }, crypto.randomUUID());Path to publish
Today, @prebit/sdk is consumed via a local file:../prebit-sdk
dependency across this ecosystem's repos — there's no npm registry to
publish to yet in this environment. npm install @prebit/sdk above is
what it'll look like once that milestone lands; nothing about the
package's shape needs to change for that.
PrebitPartnerClient
| Method | Endpoint |
|---|---|
getStore() | GET /store |
listProducts(cursor?, limit?) | GET /products |
createProduct(input, idempotencyKey) | POST /products |
updateProduct(id, input, idempotencyKey) | PATCH /products/:id |
deleteProduct(id, idempotencyKey) | DELETE /products/:id |
setInventory(id, params, idempotencyKey) | PATCH /products/:id/inventory |
listCollections(cursor?, limit?) | GET /collections |
getCollection(id) | GET /collections/:id |
createCollection(input, idempotencyKey) | POST /collections |
updateCollection(id, input, idempotencyKey) | PATCH /collections/:id |
deleteCollection(id, idempotencyKey) | DELETE /collections/:id |
listOrders(cursor?, limit?) | GET /orders |
listCustomers(cursor?, limit?) | GET /customers |
getExtensionData(namespace, key) | GET /app-data/:namespace?key= |
listExtensionData(namespace) | GET /app-data/:namespace |
putExtensionData(namespace, key, value, ttlSeconds?) | PUT /app-data/:namespace |
deleteExtensionData(namespace, key) | DELETE /app-data/:namespace?key= |
Full request/response shapes: see each resource's own API reference page.
No getProduct(id), getOrder(id), or getCustomer(id) methods exist —
those server routes don't exist either (list-only today). This isn't an
SDK gap.
Every write needs an idempotency key
await client.createProduct({ name: "Mug", price: 499 }, crypto.randomUUID());The key is a required parameter, deliberately not auto-generated internally: the whole point is that a retry of the same logical operation reuses the same key so the server replays instead of double-executing. Generate one per logical operation, reuse it across retries of that same attempt — see Errors, Pagination & Idempotency.
OAuth helpers
import {
generatePkcePair,
buildAuthorizationUrl,
exchangeAuthorizationCode,
refreshAccessToken,
revokeToken,
} from "@prebit/sdk";See OAuth for the full flow these back.
Webhook verification
import { verifyPrebitWebhookSignature } from "@prebit/sdk";
const valid = verifyPrebitWebhookSignature({
webhookSecret,
timestamp: req.headers["x-prebit-timestamp"],
rawBody,
signatureHex: req.headers["x-prebit-signature"],
});See Webhooks.
Manifest / review-scan tooling
import { parseManifest, scanSubmission } from "@prebit/sdk";This is what prebit-cli's validate/build/publish run locally,
mirrored from new-frontend's own server-side modules — "a CLI that lies
about what passes review is worse than none." See
Publishing & Manifest and
Review Process.