SDK Authentication

1. Your backend calls POST /apps/:id/tokens (JWT or X-Api-Key + X-Api-Secret).
2. Your backend returns the token to your frontend.
3. Frontend initializes SDK with token only—never keys.
4. Connect to WebSocket.

curl -X POST https://dev.vocantly.com/api/v1/apps/YOUR_APP_ID/tokens \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: pk_xxxxx" \
  -H "X-Api-Secret: sk_xxxxx" \
  -d '{
    "external_user_id": "user_123",
    "name": "Jane Doe",
    "email": "jane@example.com"
  }'

curl -X POST https://dev.vocantly.com/api/v1/apps/YOUR_APP_ID/tokens \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{
    "external_user_id": "user_123",
    "name": "Jane Doe"
  }'

import { Vocantly } from '@vocantly/sdk';

// token from your backend—never keys
const client = new Vocantly({
  wsUrl: 'wss://ws.dev.vocantly.com/ws',
  token
});

await client.connect();

client.on('error', (error) => {
  if (error.message?.includes('Token expired')) {
    refreshAndReconnect();
  }
});

async function refreshAndReconnect() {
  const { token } = await fetch('/api/chat/token').then(r => r.json());
  client.updateToken(token);
  await client.connect();
}

{
  "app_id": "app-uuid",
  "sub": "your-external-user-id",
  "sender_id": "your-external-user-id",
  "name": "User display name",
  "email": "user@example.com",
  "type": "sdk_user",
  "iat": 1234567890,
  "exp": 1234567890
}

// Your backend
app.post('/api/sdk-token', async (req, res) => {
  const user = await verifySession(req); // your auth
  
  const r = await fetch(`https://dev.vocantly.com/api/v1/apps/${process.env.APP_ID}/tokens`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Api-Key': process.env.VOCANTLY_PK,
      'X-Api-Secret': process.env.VOCANTLY_SK
    },
    body: JSON.stringify({
      external_user_id: user.id,
      name: user.name,
      email: user.email
    })
  });
  const { data } = await r.json();
  res.json({ token: data.token });
});

// Frontend: token only, never keys
const { token } = await fetch('/api/sdk-token', { credentials: 'include' }).then(r => r.json());
const client = new Vocantly({ wsUrl: 'wss://ws.dev.vocantly.com/ws', token });
await client.connect();