Node.js SDK - Configuration

NexusConfig is a plain TypeScript interface holding every value required to construct a client. Pass it to NexusClient.create().

const client = await NexusClient.create({
  endpoint: 'https://<slug>.westyx.dev', // required
  apiKey:   'wxs_...',               // required
  ttl:      60_000,                      // optional, default 60 000 ms
});

Field reference

Field	Type	Default	Description
`endpoint`	`string`	-	Full service URL, e.g. `https://<slug>.westyx.dev`. The slug embedded in the host is also used as the `Host` header on every request (Double-Gate requirement).
`apiKey`	`string?`	`undefined`	Raw `wxs_...` or `wxp_...` key. Sent verbatim in `X-Nexus-API-Key`. Optional when `wif.enabled = true`.
`ttl`	`number`	`60_000`	Local cache TTL in milliseconds. After this elapses, the next read triggers a one-shot background refresh while still serving the stale cache.
`wif`	`WIFConfig?`	`undefined`	(v0.2.0) Workload Identity Federation. When `enabled: true`, the SDK exchanges an OIDC token for a session JWT and uses bearer auth instead of the API key. See Workload identity.
`streamObserver`	`StreamObserver?`	`undefined`	(v0.2.0) Optional structured-callback observer for SSE lifecycle events. See Stream observer.
`sseReconnectCooldown`	`number \| number[]`	`undefined`	Schedule for reconnecting SSE after falling back to TTL polling. Unit: minutes. `undefined` = default `[5, 10, 20, 40, 60]` min. Number = fixed interval. Array = custom schedule (stays at last value).

Other Westyx Nexus SDKs (Spring Boot, Python, Go, .NET) call this field baseUrl / BaseUrl / base_url. The Node.js SDK uses endpoint to match the original SDK contract; both names mean the same thing.

API key types

Prefix	Access	Sync response shape
`wxs_...`	Full - all configs, all secrets, all flags	`configs`, `secrets`, and `flags` populated
`wxp_...`	Restricted - only public configs and flags (filtered server-side)	`secrets` field is entirely absent from the response

Calling getSecret(...) with a public key throws NexusPublicKeyError synchronously, before the network call.

Where to keep the API key

Standard Node.js practice - environment variables:

const client = await NexusClient.create({
  endpoint: process.env.NEXUS_URL!,
  apiKey:   process.env.NEXUS_API_KEY!,
});

For more structured config, libraries like dotenv, convict, or zod work seamlessly:

import { z } from 'zod';

const env = z.object({
  NEXUS_URL:     z.string().url(),
  NEXUS_API_KEY: z.string().regex(/^(wxs|wxp)_/),
}).parse(process.env);

const client = await NexusClient.create({
  endpoint: env.NEXUS_URL,
  apiKey:   env.NEXUS_API_KEY,
});

The SDK itself never logs the raw key.

Choosing the TTL

The TTL is a tradeoff between staleness window and redundant network traffic. With SSE enabled (the default), changes propagate in milliseconds regardless of the TTL - the TTL only matters as a safety net if the stream falls back.

Use case	Suggested `ttl`
Frequently-changing flags, latency-sensitive	`30_000` (30 s)
Standard configs with SSE	`60_000` (default)
Stable production secrets	`300_000` (5 min)
Boot-time only, never rechecked	`3_600_000` (1 hour)

When SSE is connected, the SDK clamps the effective TTL to at least 60 s - there’s no point polling more aggressively when the stream pushes events the moment they happen.

Overview

Backend SDKs

Browser SDKs

OpenFeature Providers

Node.js SDK - Configuration

Field reference

API key types

Where to keep the API key

Choosing the TTL

​Field reference

​API key types

​Where to keep the API key

​Choosing the TTL

Field reference

API key types

Where to keep the API key

Choosing the TTL