OpenAI TypeScript and JavaScript API Library

This library provides convenient access to the OpenAI REST API from TypeScript or JavaScript.

It is generated from our OpenAPI specification.

To learn how to use the OpenAI API, check out our API Reference and Documentation.

Installation

npm install openai

Installation with Deno

Deno can import the package directly from npm:

import OpenAI from 'npm:openai';

Usage

The full API of this library can be found in api.md file along with many code examples.

The primary API for interacting with OpenAI models is the Responses API. You can generate text from the model with the code below.

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env['OPENAI_API_KEY'], // This is the default and can be omitted
});

const response = await client.responses.create({
  model: 'gpt-5.5',
  instructions: 'You are a coding assistant that talks like a pirate',
  input: 'Are semicolons optional in JavaScript?',
});

console.log(response.output_text);

Multi-turn conversations

When you manage Responses API conversation history manually, preserve output items in order. Filtering response.output to messages can drop required reasoning or tool-call items and cause the next request to fail.

Use the SDK's toResponseInputItems() helper to normalize all replayable output items before adding them to the next request. For simple continuation, you can pass previous_response_id instead.

See the manual conversation state example and conversation state guide.

The previous standard (supported indefinitely) for generating text is the Chat Completions API. You can use that API to generate text from the model with the code below.

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env['OPENAI_API_KEY'], // This is the default and can be omitted
});

const completion = await client.chat.completions.create({
  model: 'gpt-5.5',
  messages: [
    { role: 'developer', content: 'Talk like a pirate.' },
    { role: 'user', content: 'Are semicolons optional in JavaScript?' },
  ],
});

console.log(completion.choices[0].message.content);

Vision

Use the Responses API to analyze images and generate text about visual content.

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env['OPENAI_API_KEY'], // This is the default and can be omitted
});

const response = await client.responses.create({
  model: 'gpt-5.5',
  input: [
    {
      role: 'user',
      content: [
        { type: 'input_text', text: 'What is in this image?' },
        {
          type: 'input_image',
          detail: 'auto',
          image_url:
            'https://api.nga.gov/iiif/a2e6da57-3cd1-4235-b20e-95dcaefed6c8/full/!800,800/0/default.jpg',
        },
      ],
    },
  ],
});

console.log(response.output_text);

Workload Identity Authentication

For secure, automated environments like cloud-managed Kubernetes, Azure, and GCP, you can use workload identity authentication with short-lived tokens from cloud identity providers instead of long-lived API keys.

The workloadIdentity parameter is mutually exclusive with apiKey.

For subject-token workload identity, the required fields are identityProviderId, serviceAccountId, and provider. X.509 workload identity instead uses an enrolled client certificate and its separately configured transport.

Kubernetes (service account tokens)

import OpenAI from 'openai';
import { k8sServiceAccountTokenProvider } from 'openai/auth';

const client = new OpenAI({
  workloadIdentity: {
    identityProviderId: 'idp-123',
    serviceAccountId: 'sa-456',
    provider: k8sServiceAccountTokenProvider('/var/run/secrets/kubernetes.io/serviceaccount/token'),
  },
});

const response = await client.chat.completions.create({
  model: 'gpt-5.5',
  messages: [{ role: 'user', content: 'Hello!' }],
});

Azure (managed identity)

import OpenAI from 'openai';
import { azureManagedIdentityTokenProvider } from 'openai/auth';

const client = new OpenAI({
  workloadIdentity: {
    identityProviderId: 'idp-123',
    serviceAccountId: 'sa-456',
    provider: azureManagedIdentityTokenProvider(),
  },
});

GCP (compute engine metadata)

import OpenAI from 'openai';
import { gcpIDTokenProvider } from 'openai/auth';

const client = new OpenAI({
  workloadIdentity: {
    identityProviderId: 'idp-123',
    serviceAccountId: 'sa-456',
    provider: gcpIDTokenProvider(),
  },
});

Custom subject token provider

import OpenAI from 'openai';

const client = new OpenAI({
  workloadIdentity: {
    identityProviderId: 'idp-123',
    serviceAccountId: 'sa-456',
    provider: {
      tokenType: 'jwt',
      getToken: async () => {
        return 'your-jwt-token';
      },
    },
  },
});

You can also customize the subject-token refresh buffer (default is 1200 seconds (20 minutes) before expiration; the effective buffer is capped at half of the actual token lifetime):

import OpenAI from 'openai';
import { k8sServiceAccountTokenProvider } from 'openai/auth';

const client = new OpenAI({
  workloadIdentity: {
    identityProviderId: 'idp-123',
    serviceAccountId: 'sa-456',
    provider: k8sServiceAccountTokenProvider('/var/token'),
    refreshBufferSeconds: 120.0,
  },
});

X.509 client certificates

Applications enrolled for X.509 workload identity can authenticate using a certificate-backed credential instead of a subject-token provider or API key. This Node.js-only integration requires the optional undici peer and currently supports only the global https://mtls.api.openai.com/v1 API endpoint.

import OpenAI from 'openai';
import { workloadIdentity } from 'openai/auth/x509-transport';

const credential = workloadIdentity.fromX509({
  certificateChain: process.env['OPENAI_X509_CLIENT_CERTIFICATE_CHAIN_PEM']!,
  privateKey: process.env['OPENAI_X509_CLIENT_PRIVATE_KEY_PEM']!,
  identityProviderId: process.env['OPENAI_X509_IDENTITY_PROVIDER_ID']!,
  serviceAccountId: process.env['OPENAI_X509_SERVICE_ACCOUNT_ID']!,
});

try {
  const client = new OpenAI({
    credential,
    project: process.env['OPENAI_X509_PROJECT_ID'] ?? null,
  });

  console.log((await client.models.list()).data.length);
} finally {
  await credential.close();
}

The SDK owns the credential's verified TLS transport, caches short-lived tokens in memory, isolates certificate generations, and bounds retries and cancellation. Set refreshBufferSeconds on the credential to configure proactive refresh; it defaults to 1,200 seconds (20 minutes) and is capped at half of the token's lifetime. For CONNECT proxies, encrypted private keys, live verification, and certificate rotation, see the X.509 workload-identity example.

Streaming responses

We provide support for streaming responses using Server-Sent Events (SSE).

import OpenAI from 'openai';

const client = new OpenAI();

const stream = await client.responses.create({
  model: 'gpt-5.5',
  input: 'Say "Sheep sleep deep" ten times fast!',
  stream: true,
});

for await (const event of stream) {
  console.log(event);
}

File uploads

Request parameters that correspond to file uploads can be passed in many different forms:

• File (or an object with the same structure)
• a fetch Response (or an object with the same structure)
• an fs.ReadStream
• the return value of our toFile or toStreamingFile helpers

import fs from 'fs';
import OpenAI, { toFile, toStreamingFile } from 'openai';

const client = new OpenAI();

// If you have access to Node `fs` we recommend using `fs.createReadStream()`:
await client.files.create({ file: fs.createReadStream('input.jsonl'), purpose: 'fine-tune' });

// Or if you have the web `File` API you can pass a `File` instance:
await client.files.create({ file: new File(['my bytes'], 'input.jsonl'), purpose: 'fine-tune' });

// You can also pass a `fetch` `Response`:
await client.files.create({
  file: await fetch('https://somesite/input.jsonl'),
  purpose: 'fine-tune',
});

// Finally, if none of the above are convenient, you can use our `toFile` helper:
await client.files.create({
  file: await toFile(Buffer.from('my bytes'), 'input.jsonl'),
  purpose: 'fine-tune',
});
await client.files.create({
  file: await toFile(new Uint8Array([0, 1, 2]), 'input.jsonl'),
  purpose: 'fine-tune',
});

// `toFile()` creates a web File, so it must buffer stream inputs before sending them.
// Use `toStreamingFile()` to stream an arbitrary web, Node, or cloud-storage stream directly:
await client.files.create({
  file: toStreamingFile(myReadableStream, 'input.jsonl', { type: 'application/jsonl' }),
  purpose: 'fine-tune',
});

Webhook Verification

Verifying webhook signatures is optional but encouraged.

Webhook verification is asynchronous. Always await unwrap() or verifySignature() before trusting the event.

For more information about webhooks, see the API docs.

Parsing webhook payloads

For most use cases, you will likely want to verify the webhook and parse the payload at the same time. To achieve this, we provide the method client.webhooks.unwrap(), which parses a webhook request and verifies that it was sent by OpenAI. This method will throw an error if the signature is invalid.

Note that the body parameter must be the raw JSON string sent from the server (do not parse it first). The .unwrap() method will parse this JSON for you into an event object after verifying the webhook was sent from OpenAI.

import { headers } from 'next/headers';
import OpenAI from 'openai';

const client = new OpenAI({
  webhookSecret: process.env.OPENAI_WEBHOOK_SECRET, // env var used by default; explicit here.
});

export async function webhook(request: Request) {
  const headersList = await headers();
  const body = await request.text();

  try {
    const event = await client.webhooks.unwrap(body, headersList);

    switch (event.type) {
      case 'response.completed':
        console.log('Response completed:', event.data);
        break;
      case 'response.failed':
        console.log('Response failed:', event.data);
        break;
      default:
        console.log('Unhandled event type:', event.type);
    }

    return Response.json({ message: 'ok' });
  } catch (error) {
    console.error('Invalid webhook signature:', error);
    return new Response('Invalid signature', { status: 400 });
  }
}

Verifying webhook payloads directly

In some cases, you may want to verify the webhook separately from parsing the payload. If you prefer to handle these steps separately, we provide the method client.webhooks.verifySignature() to only verify the signature of a webhook request. Like .unwrap(), this method will throw an error if the signature is invalid.

Note that the body parameter must be the raw JSON string sent from the server (do not parse it first). You will then need to parse the body after verifying the signature.

import { headers } from 'next/headers';
import OpenAI from 'openai';

const client = new OpenAI({
  webhookSecret: process.env.OPENAI_WEBHOOK_SECRET, // env var used by default; explicit here.
});

export async function webhook(request: Request) {
  const headersList = await headers();
  const body = await request.text();

  try {
    await client.webhooks.verifySignature(body, headersList);

    // Parse the body after verification
    const event = JSON.parse(body);
    console.log('Verified event:', event);

    return Response.json({ message: 'ok' });
  } catch (error) {
    console.error('Invalid webhook signature:', error);
    return new Response('Invalid signature', { status: 400 });
  }
}

Handling errors

When the library is unable to connect to the API, or if the API returns a non-success status code (i.e., 4xx or 5xx response), a subclass of APIError will be thrown:

const job = await client.fineTuning.jobs
  .create({ model: 'gpt-4o', training_file: 'file-abc123' })
  .catch(async (err) => {
    if (err instanceof OpenAI.APIError) {
      console.log(err.requestID);
      console.log(err.status); // 400
      console.log(err instanceof OpenAI.BadRequestError); // true for an HTTP 400 response
      console.log(err.headers); // response Headers
    } else {
      throw err;
    }
  });

Error codes are as follows:

Status Code	Error Type
400	BadRequestError
401	AuthenticationError
403	PermissionDeniedError
404	NotFoundError
409	ConflictError
422	UnprocessableEntityError
429	RateLimitError
>=500	InternalServerError
N/A	APIConnectionError

Retries

Certain errors will be automatically retried 2 times by default, with a short exponential backoff. Connection errors (for example, due to a network connectivity problem), 408 Request Timeout, 409 Conflict, 429 Rate Limit, and >=500 Internal errors will all be retried by default.

You can use the maxRetries option to configure or disable this:

// Configure the default for all requests:
const client = new OpenAI({
  maxRetries: 0, // default is 2
});

// Or, configure per-request:
await client.chat.completions.create({ messages: [{ role: 'user', content: 'How can I get the name of the current day in JavaScript?' }], model: 'gpt-5.5' }, {
  maxRetries: 5,
});

Timeouts

Requests time out after 10 minutes by default. You can configure this with a timeout option:

// Configure the default for all requests:
const client = new OpenAI({
  timeout: 20 * 1000, // 20 seconds (default is 10 minutes)
});

// Override per-request:
await client.chat.completions.create({ messages: [{ role: 'user', content: 'How can I list all files in a directory using Python?' }], model: 'gpt-5.5' }, {
  timeout: 5 * 1000,
});

On timeout, an APIConnectionTimeoutError is thrown.

Note that requests which time out will be retried twice by default.

Cancellation

Pass an AbortSignal in the request's signal option to cancel a request, including while its response body is being read.

When native signal composition is unavailable or incompatible with the supplied signal, the SDK shares one listener per caller signal and holds request callbacks weakly. Cleanup depends on garbage collection; keeping a raw response or its body alive can keep its cancellation subscription alive after consumption. Older runtimes without WeakRef or FinalizationRegistry keep the existing fallback, which can retain a listener for each successful request until the caller aborts.

Request IDs

For more information on debugging requests, see these docs

All object responses in the SDK provide a _request_id property which is added from the x-request-id response header so that you can quickly log failing requests and report them back to OpenAI.

const response = await client.responses.create({ model: 'gpt-5.5', input: 'testing 123' });
console.log(response._request_id); // req_123

You can also access the Request ID using the .withResponse() method:

const { data: stream, request_id } = await openai.responses
  .create({
    model: 'gpt-5.5',
    input: 'Say this is a test',
    stream: true,
  })
  .withResponse();

Auto-pagination

List methods in the OpenAI API are paginated. You can use the for await … of syntax to iterate through items across all pages:

async function fetchAllFineTuningJobs(params) {
  const allFineTuningJobs = [];
  // Automatically fetches more pages as needed.
  for await (const fineTuningJob of client.fineTuning.jobs.list({ limit: 20 })) {
    allFineTuningJobs.push(fineTuningJob);
  }
  return allFineTuningJobs;
}

Alternatively, you can request a single page at a time:

let page = await client.fineTuning.jobs.list({ limit: 20 });
for (const fineTuningJob of page.data) {
  console.log(fineTuningJob);
}

// Convenience methods are provided for manually paginating:
while (page.hasNextPage()) {
  page = await page.getNextPage();
  // ...
}

Realtime API

The Realtime API enables you to build low-latency, multi-modal conversational experiences. It currently supports text and audio as both input and output, as well as function calling through a WebSocket connection.

import { OpenAIRealtimeWebSocket } from 'openai/realtime/websocket';

const rt = new OpenAIRealtimeWebSocket({ model: 'gpt-realtime-2' });

rt.on('response.output_text.delta', (event) => process.stdout.write(event.delta));

Realtime model sessions can opt in to reconnection with reconnect: true. Each reconnection starts a new server session, so your application must restore its state. See the Realtime guide for connection options and session restoration.

Microsoft Azure OpenAI

To use this library with Azure OpenAI, use the AzureOpenAI class instead of the OpenAI class.

[!IMPORTANT] The Azure API shape slightly differs from the core API shape which means that the static types for responses / params won't always be correct.

import { AzureOpenAI } from 'openai';
import { getBearerTokenProvider, DefaultAzureCredential } from '@azure/identity';

const credential = new DefaultAzureCredential();
const scope = 'https://cognitiveservices.azure.com/.default';
const azureADTokenProvider = getBearerTokenProvider(credential, scope);

const openai = new AzureOpenAI({
  azureADTokenProvider,
  apiVersion: '<The API version, e.g. 2024-10-01-preview>',
});

const result = await openai.chat.completions.create({
  model: 'gpt-5.5',
  messages: [{ role: 'user', content: 'Say hello!' }],
});

console.log(result.choices[0]!.message?.content);

For more information on support for the Azure API, see docs/azure.md.

Amazon Bedrock

To use this library with Amazon Bedrock's OpenAI-compatible API, configure the standard OpenAI client with the Bedrock provider:

import OpenAI from 'openai';
import { bedrock } from 'openai/providers/bedrock/aws';

const client = new OpenAI({
  provider: bedrock({ region: 'us-west-2' }),
});

const response = await client.responses.create({
  model: 'openai.gpt-5.4',
  input: 'Say hello!',
});

console.log(response.output_text);

Use a model that supports the Responses API. A model returned by the Models API may support a different Bedrock inference API instead.

This uses the regional https://bedrock-mantle.<region>.api.aws/openai/v1 endpoint. The region can also come from AWS_REGION or AWS_DEFAULT_REGION, and AWS_BEDROCK_BASE_URL can override the endpoint.

The AWS entrypoint uses the standard AWS credential chain by default. It also accepts a named profile, static credentials, or a custom credential provider. Install its peer dependencies before importing it:

npm install @aws-sdk/credential-provider-node @smithy/hash-node @smithy/signature-v4

The AWS entrypoint uses normal static imports so bundlers and serverless packagers can trace these dependencies. If one is missing, importing openai/providers/bedrock/aws fails immediately with the runtime's normal module-not-found error, for example:

Cannot find module '@aws-sdk/credential-provider-node'

For Bedrock API key authentication, import bedrock from openai/providers/bedrock instead. That entrypoint has no AWS dependencies and works in browser-compatible runtimes when dangerouslyAllowBrowser is enabled. SigV4 authentication is supported in Node.js and compatible server runtimes and requires replayable request bodies. The legacy, bearer-only BedrockOpenAI class remains available for compatibility.

For more information on support for Amazon Bedrock, see docs/bedrock.md.

Advanced Usage

Accessing raw Response data (e.g., headers)

The "raw" Response returned by fetch() can be accessed through the .asResponse() method on the APIPromise type that all methods return. This method returns as soon as the headers for a successful response are received and does not consume the response body, so you are free to write custom parsing or streaming logic.

You can also use the .withResponse() method to get the raw Response along with the parsed data. Unlike .asResponse() this method consumes the body, returning once it is parsed.

const client = new OpenAI();

const httpResponse = await client.responses
  .create({ model: 'gpt-5.5', input: 'say this is a test.' })
  .asResponse();

// access the underlying web standard Response object
console.log(httpResponse.headers.get('X-My-Header'));
console.log(httpResponse.statusText);

const { data: modelResponse, response: raw } = await client.responses
  .create({ model: 'gpt-5.5', input: 'say this is a test.' })
  .withResponse();
console.log(raw.headers.get('X-My-Header'));
console.log(modelResponse);

Logging

[!IMPORTANT] All log messages are intended for debugging only. The format and content of log messages may change between releases.

Log levels

The log level can be configured in two ways:

1. Via the OPENAI_LOG environment variable
2. Using the logLevel client option (overrides the environment variable if set)

import OpenAI from 'openai';

const client = new OpenAI({
  logLevel: 'debug', // Show all log messages
});

Available log levels, from most to least verbose:

• 'debug' - Show debug messages, info, warnings, and errors
• 'info' - Show info messages, warnings, and errors
• 'warn' - Show warnings and errors (default)
• 'error' - Show only errors
• 'off' - Disable all logging

At the 'debug' level, HTTP request and response metadata and headers are logged. Authentication-related headers are redacted. Serialized string request bodies, including JSON, and parsed JSON response bodies are summarized by their format and JavaScript string length instead of being logged in full. This avoids inspecting or copying large payloads for logging and leaves the actual request and response data unchanged. Log arguments are additionally sanitized to redact credential-like fields and URL credentials. Multipart bodies and raw responses are logged as sanitized diagnostic objects; streams and binary values are redacted without being read or consumed. Remaining diagnostics may still contain sensitive data.

Custom logger

By default, this library logs to globalThis.console. You can also provide a custom logger. Most logging libraries are supported, including pino, winston, bunyan, consola, and signale. If your logger doesn't work, please open an issue.

When providing a custom logger, the logLevel option still controls which messages are emitted, messages below the configured level will not be sent to your logger.

import OpenAI from 'openai';
import pino from 'pino';

const logger = pino();

const client = new OpenAI({
  logger: logger.child({ name: 'OpenAI' }),
  logLevel: 'debug', // Send all messages to pino, allowing it to filter
});

Making custom/undocumented requests

This library is typed for convenient access to the documented API. If you need to access undocumented endpoints, params, or response properties, the library can still be used.

Undocumented endpoints

To make requests to undocumented endpoints, you can use client.get, client.post, and other HTTP verbs. Options on the client, such as retries, will be respected when making these requests.

await client.post('/some/path', {
  body: { some_prop: 'foo' },
  query: { some_query_arg: 'bar' },
});

Undocumented request params

To make requests using undocumented parameters, you may use // @ts-expect-error on the undocumented parameter. This library doesn't validate at runtime that the request matches the type, so any extra values you send will be sent as-is.

client.chat.completions.create({
  // ...
  // @ts-expect-error baz is not yet public
  baz: 'undocumented option',
});

For requests with the GET verb, any extra params will be in the query, all other requests will send the extra param in the body.

If you want to explicitly send an extra argument, you can do so with the query, body, and headers request options.

Undocumented response properties

To access undocumented response properties, you may access the response object with // @ts-expect-error on the response object, or cast the response object to the requisite type. Like the request params, we do not validate or strip extra properties from the response from the API.

Customizing the fetch client

If you want to use a different fetch function, you can either polyfill the global:

import fetch from 'my-fetch';

globalThis.fetch = fetch;

Or pass it to the client:

import OpenAI from 'openai';
import fetch from 'my-fetch';

const client = new OpenAI({ fetch });

Fetch options

If you want to set custom fetch options without overriding the fetch function, you can provide a fetchOptions object when instantiating the client or making a request. (Request-specific options override client options.)

import OpenAI from 'openai';

const client = new OpenAI({
  fetchOptions: {
    // `RequestInit` options
  },
});

Configuring proxies

To modify proxy behavior, you can provide custom fetchOptions that add runtime-specific proxy options to requests:

Node [docs]

import OpenAI from 'openai';
import { fetch, ProxyAgent } from 'undici';

const proxyAgent = new ProxyAgent('http://localhost:8888');
const client = new OpenAI({
  fetch,
  fetchOptions: {
    dispatcher: proxyAgent,
  },
});

Undici-specific options like dispatcher must be paired with the matching fetch implementation.

Bun [docs]

import OpenAI from 'openai';

const client = new OpenAI({
  fetchOptions: {
    proxy: 'http://localhost:8888',
  },
});

Deno [docs]

import OpenAI from 'npm:openai';

const httpClient = Deno.createHttpClient({ proxy: { url: 'http://localhost:8888' } });
const client = new OpenAI({
  fetchOptions: {
    client: httpClient,
  },
});

Mutual TLS

The API mTLS beta combines your API key with a client certificate. For enrollment, certificate requirements, activation, and supported endpoints, see the OpenAI Mutual TLS Beta Program. Configure mTLS on your runtime's HTTP transport, then pass that transport to the SDK with fetch and fetchOptions. Set baseURL to the mTLS endpoint explicitly:

import { readFile } from 'node:fs/promises';
import { Agent, fetch as undiciFetch } from 'undici';
import OpenAI from 'openai';

const dispatcher = new Agent({
  connect: {
    // One PEM chain: leaf certificate first, then required intermediates.
    cert: await readFile('/path/to/client-cert-chain.pem'),
    key: await readFile('/path/to/client-key.pem'),
  },
});

const client = new OpenAI({
  apiKey: process.env['OPENAI_API_KEY'],
  baseURL: 'https://mtls.api.openai.com/v1',
  fetch: undiciFetch,
  fetchOptions: {
    dispatcher,
    redirect: 'manual',
  },
});

Use https://mtls-eu.api.openai.com/v1 for EU Data Residency. The example uses manual redirects so the certificate-bearing transport does not automatically follow a redirect to another host. Close transports your application creates when they are no longer needed.

See the runnable Node.js, Deno, and Bun mTLS examples for certificate-chain setup, optional Node.js encrypted-key support, and runtime-specific transport cleanup.

Frequently Asked Questions

Semantic versioning

This package generally follows SemVer conventions, though certain backwards-incompatible changes may be released as minor versions:

1. Changes that only affect static types, without breaking runtime behavior.
2. Changes to library internals which are technically public but not intended or documented for external use. (Please open a GitHub issue to let us know if you are relying on such internals.)
3. Changes that we do not expect to impact the vast majority of users in practice.

We take backwards-compatibility seriously and work hard to ensure you can rely on a smooth upgrade experience.

We are keen for your feedback; please open an issue with questions, bugs, or suggestions.

Requirements

TypeScript >= 4.9 is supported.

The following runtimes are supported:

• Node.js 22 and 24 LTS. Node.js 22 is the minimum supported version.

• Deno v1.28.0 or higher.

• Bun 1.0 or later.

• Cloudflare Workers.

• Vercel Edge Runtime.

• Jest 28 or greater with the "node" environment ("jsdom" is not supported at this time).

• Nitro v2.6 or greater.

• Web browsers: disabled by default to avoid exposing your secret API credentials. Enable browser support by explicitly setting dangerouslyAllowBrowser to true.

  Why is this dangerous?

  Enabling the dangerouslyAllowBrowser option can be dangerous because it exposes your secret API credentials in the client-side code. Web browsers are inherently less secure than server environments, any user with access to the browser can potentially inspect, extract, and misuse these credentials. This could lead to unauthorized access using your credentials and potentially compromise sensitive data or functionality.

  When might this not be dangerous?

  In certain scenarios where enabling browser support might not pose significant risks:

  • Internal Tools: If the application is used solely within a controlled internal environment where the users are trusted, the risk of credential exposure can be mitigated.
  • Public APIs with Limited Scope: If your API has very limited scope and the exposed credentials do not grant access to sensitive data or critical operations, the potential impact of exposure is reduced.
  • Development or debugging purpose: Enabling this feature temporarily might be acceptable, provided the credentials are short-lived, aren't also used in production environments, or are frequently rotated.

Note that React Native is not supported at this time.

If you are interested in other runtime environments, please open or upvote an issue on GitHub.

Node.js 20 reached end of life on April 30, 2026 and is no longer supported. Previously published SDK releases remain available, but receive no guaranteed fixes or security backports for unsupported Node.js versions. See the Node.js version support policy for lifecycle, deprecation, and release rules.

Contributing

Please share bug reports and feature requests through GitHub issues. Pull requests are limited to repository collaborators; we do not accept pull requests from non-collaborators. See CONTRIBUTING.md for the contribution policy and development guide. For security vulnerabilities, follow SECURITY.md.