Authentication

Nutifar uses two different authentication methods depending on where your code runs.

Server-side: API keys

Used by @nutifar/node. This key has full account access — creating, sending, and managing notifications across all channels.

const nutifar = new Nutifar({ apiKey: process.env.NUTIFAR_API_KEY! });

Client-side: scoped connect-tokens

Used by @nutifar/web and @nutifar/expo for features that run in the browser or on-device — like the in-app real-time channel.

Instead of your API key, client SDKs authenticate with a short-lived, scoped JWT ("connect-token") that your backend issues on request. This keeps your API key off the client entirely.

Typical flow:

1. Your frontend asks your backend for a connect-token (your backend call, not a Nutifar endpoint).
2. Your backend calls Nutifar's server SDK to mint a token + userId.
3. Your frontend passes that token to @nutifar/web, which handles connecting, refreshing, and reconnecting automatically.

// on your backend
const token = await nutifar.tokens.create({
  userId: "user_456",
  scope: ["in-app:connect"],
});

// on your frontend
import { NutifarClient } from "@nutifar/web";

const client = new NutifarClient({ connectToken: token });

The SDK refreshes the token before it expires and reconnects on drops — you don't need to manage that yourself.

Which one do I need?