# SDK reference

> The @devzity/sdk API, generated from its TypeScript source.

`@devzity/sdk` is the **server-side** Node.js (18+) / TypeScript SDK. It holds your secret key, so it must never be bundled for a browser or mobile app — importing it in a browser build fails on purpose. Next.js apps can use the thin `@devzity/next` wrapper (`createDevzity()` reads `DEVZITY_SECRET_KEY`; `verifyDevzityWebhook(request)` verifies a Route Handler webhook using `DEVZITY_WEBHOOK_SECRET`).

**SDK preview:** This package is not publicly published yet, so there is nothing to install from a registry.

- Use the REST API (curl or plain fetch). See REST & other languages.
- Or build the package from the repository (`pnpm pack` in sdk/javascript) for local development.

```ts
import { Devzity } from "@devzity/sdk"

const devzity = new Devzity({ secretKey: process.env.DEVZITY_SECRET_KEY! })
```

**Amounts:** `amount: 500` is fine for simple values; for exact money pass a string (`"500.50"`). Anything that can't be represented exactly with two decimals is rejected, not rounded.

**Forward compatibility:** responses may contain a payment status, method or channel newer than your SDK — they are passed through as strings, so keep a default branch. A webhook event type newer than your SDK is verified and returned as `type: "unknown"` with `rawType` and the raw `data.object`, so you can log and ignore it. Request-side values stay strict.

**`baseUrl`:** a preview SDK build has no built-in API URL — pass `baseUrl: process.env.DEVZITY_API_URL` (a release ships with it locked, and then it is optional).

Defaults: 30 s request timeout, up to 2 automatic retries (network errors, `429` honoring `Retry-After`, `502/503/504`) that always reuse the same idempotency key. The environment is inferred from the key prefix.

See the OpenAPI document for the full reference: https://docs.devzity.com/openapi/devzity-v1.yaml