Skip to main content
@devicai/sdk is the official TypeScript client for the Devic public API. It runs on your server, never in a browser.

The one idea

devic.* speaks for your workspace. devic.auth(tenantId) speaks for one of your customers inside it.
Everything reached through a scope carries that customer’s identity, so it cannot be left off one call by accident — which is the failure with no symptom: the message goes through, the answer looks right, and the conversation is filed under your workspace instead of under your customer. And what a customer must not do is simply not reachable from there. There is no acme.toolServers, no acme.projects, no acme.documents.

What is on it


Minting a session for the browser

This is the reason most backends install it. Your page needs a credential, and it must not be your API key.
The identity comes from your own login, never from the request body — that is the whole security property. Then, in the page, with @devicai/ui:
See Tenant sessions for what the token can and cannot do.
You do not have to expose a renewal endpoint. Mint the session inside your own login with a lifetime matching your session (session({ ttlSeconds: 8 * 3600 }), up to 12 h) and put it in a cookie. Do set onSessionExpired if you take that route: there is nothing to renew from, so without it the chat goes quiet at the exact moment the user’s login expires.

Making it compulsory

All of the above is a convention until the key is unable to do anything else. Set the key’s identity mode to signed in the console and it can mint sessions and nothing more — every other /api/v1 call with that key alone answers 401.
Which means a signed key is for exactly this: minting sessions in front of a browser. Anything else your server does — provisioning assistants, reading costs, running agents — needs a second key left on open. Two keys, two jobs. See API keys.

CLI

The same API from a terminal.

Tenant sessions

What the minted token is allowed to do.

Embedding in your product

The React side of the same flow.

API reference

Everything the SDK wraps.