@devicai/sdk is the official TypeScript client for the Devic public API. It runs on your server, never in a browser.
The one idea
devic.* speaks for your workspace. devic.auth(tenantId) speaks for one of your customers inside it.
acme.toolServers, no acme.projects, no acme.documents.
What is on it
Minting a session for the browser
This is the reason most backends install it. Your page needs a credential, and it must not be your API key.@devicai/ui:
Making it compulsory
All of the above is a convention until the key is unable to do anything else. Set the key’s identity mode tosigned in the console and it can mint sessions and nothing more — every other /api/v1 call with that key alone answers 401.
signed key is for exactly this: minting sessions in front of a browser. Anything else your server does — provisioning assistants, reading costs, running agents — needs a second key left on open. Two keys, two jobs. See API keys.
Related
CLI
The same API from a terminal.
Tenant sessions
What the minted token is allowed to do.
Embedding in your product
The React side of the same flow.
API reference
Everything the SDK wraps.