SDK credentials and origins

Create a client with an exact HTTPS origin: no path, query, fragment or embedded user information. The bearer credential identifies one provisioned principal and its tenant. Do not give a producer an operator or publisher credential as a shortcut.

import { HAIPClient } from '@haip/sdk';

const client = new HAIPClient(origin, producerToken);

For the disposable local walkthrough only, the third constructor argument permits HTTP on localhost or 127.0.0.1:

const localClient = new HAIPClient(localOrigin, temporaryProducerToken, true);

This exception does not allow public plain-HTTP hosts. Keep credentials out of URLs, browser bundles, committed configuration and ordinary logs. Credential rotation changes the token, not the stable producer identity or its quotas. The SDK does not exchange a bearer credential for a human session. Review links are locators; the person must sign in through the trusted host and confirm there. Server authentication describes those checks. A service’s trust-discovery endpoint is descriptive. Configure accepted signing issuers and keys through an independent trusted channel before verifying receipts, events or execution authority.

HAIP 2 draft

Protocol

Reference service

TypeScript SDK

Command line

Local examples

Unsupported HAIP 1 archive