SDK

The SDK is TDACorp's TypeScript package for the parts of an integration that are easy to get subtly wrong: discovery, PKCE, the pushed request, signed client authentication, callback checks, token handling and proof of possession. These pages document it module by module. They are for developers who use it, and for anyone reviewing what it does on their behalf.

The SDK is a convenience, not a requirement. Everything it does is plain HTTP. It is the package @tdacorp/identity-sdk on the public npm registry, MIT-licensed, and its first release is 2.0.0 (pnpm add @tdacorp/identity-sdk). It needs Node 22.12 or later.

The SDK is split by job, and each job has its own subpath so you import only what you need. The relying party is the protocol half of a login and never touches a cookie. The route adapters wrap it for a framework. The resource-server module verifies tokens in an API. The service client is for a service that acts as itself. The sealed module protects small values in cookies, and the token tool keeps a service token in a file.

login:    relying party  ->  route helpers  ->  Next.js adapterAPI:      resource-server verification   (+ decision client)service:  service client  ->  token command-line toolcookies:  sealed sessions

I am adding sign-in to a Next.js app.

1. Quickstart: the whole path in one page.
2. Next.js adapter: what each mounted route does.
3. Relying-party module: what it checks and returns.

I am protecting an API.

1. Resource-server verification: create it and verify a request.
2. Decision client and framework adapters: how your API asks identity what a person may do.
3. Data API: tell identity about your resources, once the flags are on.

I run a backend service.

1. Service client: tokens for yourself and for another service.
2. Token command-line tool: a sidecar that keeps a token fresh.

Relying-party module answers how to create it, its methods, what the callback handler checks, its results, its DPoP helpers and its errors. Next.js adapter answers how to mount login, callback, logout and back-channel logout with one catch-all route, and what each route does, its options and what the login callback receives.

Resource-server verification answers how to verify an access token and its proof in your own API, what comes back and which refusals to send. Service client answers how a service gets tokens for itself, calls another service with an exchanged token and builds the proof headers.

Decision client and framework adapters answers how the SDK asks identity whether a person may do something and caches the answer. It is Available, including the credential that signs the per-request proof the decision API requires. Data API answers how your product writes its resources and relations, searches who can reach what, and reads its own writes back; it is In development behind the authz_write_api and authz_search_api flags, both default OFF. Sealed sessions answers how to encrypt a payload into a cookie value or sign a session cookie, with a rotating secret. Token command-line tool answers how to keep a service access token in a file, and the same behaviour as library functions.

Node 22.12 or later, the package from the npm registry and a registered client. Choosing an integration says which module fits your client type, and Register a client says how to get a client id.

Where do I get the SDK? From the public npm registry: pnpm add @tdacorp/identity-sdk. See Choosing an integration.

Does it store my sessions? No. The relying party never touches a cookie or a session. See Relying-party module.

Does it retry a 429? Yes, a bounded number of times, and only a 429. The relying party and the service client wait for Retry-After and then give up with an error you can handle. A 5xx and OAuth errors are never retried. See Rate limits and retries.

Can I use it in a browser-only app? Not yet. Single-page and native clients have no SDK support. See Choosing an integration.

Is the decision client ready? Yes, it is Available. See Decision client and framework adapters.

It does not explain the protocol behind each call, which is in Flows and Endpoints. It does not cover other languages, but the Raw HTTP walkthrough shows every request. Task-based guides are in Build with identity.