SDK integration

How the auditor SDK maps onto the sandbox HTTP API — code snippets for @enfinitos/sdk-auditor and @enfinitos/cli pointed at the sandbox. Other SDKs ship at the April 2027 production launch.

The sandbox HTTP API is a strict subset of the production API shape. The auditor SDK (@enfinitos/sdk-auditor) is published today and integrates with the sandbox by pointing its base URL at https://sandbox.api.enfinitos.com. Other SDKs (sdk-operator-web, sdk-brand) ship at the April 2027 production launch — code snippets below show the expected integration shape for planning purposes.

This page is the integration map: which SDK surface maps to which sandbox endpoint, with copy-pasteable code snippets.

@enfinitos/sdk-auditor

Verify any sandbox-issued pack offline. The sandbox publishes the same runtime-keys directory shape as production, with the sandbox-only key. This SDK is published today.

import { verifyAll } from "@enfinitos/sdk-auditor";

const packResponse = await fetch(
  "https://sandbox.api.enfinitos.com/api/sandbox/proof-packs/PAK_ID",
  { credentials: "include" },
);
const { data } = await packResponse.json();

const report = await verifyAll(
  {
    pack: data.pack,
    metering: data.pack.metering,
    settlement: data.pack.settlement,
    verificationKeys: [data.verificationKey],
  },
  { verificationKeySource: "local" },
);

console.log(report.status); // "VALID"

The auditor SDK is fully browser-compatible as of v0.0.2 — the previous version required node:crypto; the current version uses @noble/ed25519 + @noble/hashes + Web APIs only, so this exact snippet runs in a browser tab, a Cloudflare Worker, Node, Deno, or Bun.

@enfinitos/sdk-brand

@enfinitos/sdk-brand ships at the April 2027 production launch. The integration shape below is for planning purposes.

The Brand SDK is read-only — it queries delivery proof, metering, and settlement records scoped to a brand’s campaigns. The sandbox runs the brand from the operator side (we sign offers from one sandbox org to another), so the brand surface is presented through the same /api/sandbox/proof-packs and /api/sandbox/inspect endpoints.

import { BrandClient } from "@enfinitos/sdk-brand";

const client = new BrandClient({
  apiKey: "sandbox-cookie-equivalent",
  baseUrl: "https://sandbox.api.enfinitos.com/api/sandbox",
  // The sandbox auths via cookie; the SDK supports cookie-mode
  // when constructed with `auth: { mode: "cookie" }`.
  auth: { mode: "cookie" },
});

const packs = await client.proof.list();

@enfinitos/sdk-operator-web

@enfinitos/sdk-operator-web ships at the April 2027 production launch. The integration shape below is for planning purposes.

The Operator Web SDK is a React component library. Wire it against the sandbox by configuring its OperatorProvider with the sandbox base URL:

import { OperatorProvider, RightsRegistry, ProofCentre } from "@enfinitos/sdk-operator-web";

export function SandboxDashboard() {
  return (
    <OperatorProvider
      config={{
        apiBaseUrl: "https://sandbox.api.enfinitos.com/api/sandbox",
        authMode: "cookie",
        environment: "sandbox",
      }}
    >
      <RightsRegistry />
      <ProofCentre />
    </OperatorProvider>
  );
}

The sandbox API surfaces a subset of the production endpoints: rights, offers, challenges, proof, runtime-keys. Components that hit endpoints outside that subset (billing, pacing, pilot programmes) currently render an empty state when pointed at the sandbox. Wiring the remaining surfaces is on the post-launch roadmap.

@enfinitos/cli

The CLI has dedicated sandbox subcommands — see the CLI page for the full reference.

npm install -g @enfinitos/cli
enfinitos sandbox provision
enfinitos sandbox demo --count 12
enfinitos sandbox list
enfinitos sandbox get pak_xyz --save pack.json
enfinitos sandbox verify pack.json

Direct HTTP

Every SDK is a thin client over the same HTTP API. If you’d rather not adopt a client, the API is fully documented in the API reference and the snippets above translate to direct fetch calls one-to-one.

What’s the same vs. production integration

Surface	Sandbox	Production
Auth	Cookie (enf_sandbox_tenant)	Bearer token + tenant scope
Base URL	https://sandbox.api.enfinitos.com	https://api.enfinitos.com (at April 2027 launch)
Rate limit	10 req/10s + 200/hour per IP	Per-tenant configurable
Idempotency keys	Not enforced	Required on mutating endpoints
Webhook backplane	Not exposed	Production tenants subscribe
OAuth flow	Not used	Required for human reviewers

A buyer’s integration team can write their auditor SDK wiring against the sandbox today. Other SDKs ship at the April 2027 production launch — type definitions, response shapes, error codes, and state-machine semantics will be identical.