Go SDK - API Reference

client, err := nexus.NewClient(ctx, nexus.Config{
    BaseURL: "...",
    APIKey:  "...",
})
if err != nil {
    log.Fatal(err)
}

val, ok := client.GetConfig("database.url")
if !ok {
    return errors.New("not configured")
}
url := val.(string)

isOn := client.GetFlag("checkout.v2", false)

results, err := client.EvaluateAB(ctx,
    []string{"checkout.v2", "homepage.banner"},
    "user-42",
    map[string]any{
        "country": "HU",
        "plan":    "pro",
    },
)
if err != nil {
    if errors.Is(err, nexus.ErrABAddonNotAvailable) {
        // Project does not have the AB Testing add-on enabled.
        return
    }
    return
}
if results["checkout.v2"] {
    // bucketed into the new checkout
}

const (
    SecretTypeText = "text"
    SecretTypeFile = "file"
)

val, err := client.GetSecret("DB_PASSWORD")
if err != nil {
    if errors.Is(err, nexus.ErrPublicKeyRestricted) { /* ... */ }
    if errors.Is(err, nexus.ErrServiceKindMismatch) { /* ... */ }
    if errors.Is(err, nexus.ErrSecretNotFound)     { /* ... */ }
}

<os.TempDir()>/nexus-<sanitised-key>-<sha256-prefix>

path, ok := client.GetSecretFilePath("TLS_CERT")
if !ok {
    log.Fatal("nexus: TLS_CERT is missing or not a file-type secret")
}
cert, err := tls.LoadX509KeyPair(path, keyPath)

client, err := nexus.NewClient(ctx, cfg)
if err != nil {
    log.Fatal(err)
}
defer client.Close()

err := client.SetSecret(ctx, "stripe.key", newKey)
if err != nil {
    if errors.Is(err, nexus.ErrPublicKeyRestricted) { /* ... */ }
    if errors.Is(err, nexus.ErrRateLimited) { /* ... */ }
}

err := client.DeleteSecret(ctx, "old.api.key")

err := client.DeleteSecretVersion(ctx, "db.password", 2)

for {
    client.RunStream(ctx)
    select {
    case <-ctx.Done():
        return
    case <-time.After(5 * time.Minute):
        // retry SSE after fallback
    }
}

var (
    ErrSyncFailed             // wraps the cause when NewClient's initial sync fails
    ErrUnauthorized           // HTTP 401
    ErrNotFound               // HTTP 404
    ErrPublicKeyRestricted    // GetSecret with public key
    ErrSecretNotFound         // unknown secret key
    ErrBilling                // HTTP 402 - tenant has overdue invoices
    ErrServiceKindMismatch    // GetSecret on a kind=frontend service
    ErrABAddonNotAvailable    // EvaluateAB on a project without the AB Testing add-on
    ErrWIFNotConfigured       // WIF enabled but no usable provider matched
    ErrWIFTokenExchangeFailed // POST /v1/auth/token-exchange returned non-2xx
    ErrSessionExpired         // WIF session JWT expired and refresh failed
)

// QuarantinedError is returned when the server responds with 429 + quarantine body.
// Inspect ExpiresAt to know when normal sync resumes.
type QuarantinedError struct {
    Reason    string
    ExpiresAt time.Time
}

type Logger interface {
    Debugf(format string, args ...any)
    Infof(format string, args ...any)
    Errorf(format string, args ...any)
}

type StreamObserver interface {
    OnConnected()
    OnDisconnected(err error)
    OnEvent(name string)
    OnReconnectAttempt(attempt int)
    OnFallback(reason string)
    OnQuarantined(reason string, expiresAt time.Time)
}

type WIFConfig struct {
    Enabled     bool
    Provider    string         // "kubernetes" | "aws" | "gcp" | "azure" | "auto"
    TokenSource TokenSourceFunc
    Audience    string         // default "westyx-nexus"
}

type TokenSourceFunc func(ctx context.Context) (string, error)