Skip to main content

​
SDK matrix

​
Choosing an SDK

Backend service

Use Go, Node.js, Python, .NET, Spring Boot, Kotlin, PHP, or Rust. Backend services use secret keys (backend services only) and have access to secrets, configs, and flags. Workload Identity Federation (WIF) is supported on all backend SDKs.

Frontend / browser

Use Angular, React, or Vue. Browser SDKs use public keys (browser/frontend, safe to expose) and have access to configs and flags only. Secrets are never sent to the browser.

​
Shared behaviour across all SDKs

All backend SDKs implement the same core contract:
  • TTL-based cache - initial sync populates the cache; background refresh keeps it current without blocking callers
  • ETag / 304 - unchanged data resets the TTL without re-downloading the full payload
  • SSE live updates - value changes propagate within milliseconds; falls back to TTL polling after 3 transport errors
  • 402 handling - when billing is blocked, background sync halts and the cached values are served until resolved
  • Quarantine handling - 429 with quarantine body pauses sync until expiresAt; stream reconnects without counting as a transport failure
  • Service kind enforcement - GetSecret is blocked with an error on kind=frontend services regardless of key type
  • Write API (v0.5.0) - SetSecret, DeleteSecret, DeleteSecretVersion on all backend SDKs; public keys are rejected before the network call

​
Versioning

All SDKs are at v0.6.0.
The PHP package (westyx/nexus) requires a Composer repository entry. See the PHP SDK installation guide for the full setup.