DRT Public API

A unified NPM package for typed API clients generated from OpenAPI specs. This package provides typed access to public services via fetch.

📦 Installation

npm install @drttix/drt-sdk

📦 Usage

import { DRT } from "@drttix/drt-sdk";

DRT.init({
  shopperGuid: "your-shopper-guid",
  accountId: "your-account-id",
  apiKey: "your-api-key",
});

const theme = await DRT.shopper.account.getTheme();

Backend serving many shoppers/accounts

By default the SDK is a singleton: one shopperGuid/accountId for the whole process, set once via DRT.init(). A backend that proxies calls on behalf of many different shoppers can opt into shopperScope: 'per-request' instead, and pass { shopperGuid, accountId } as the last argument to each shopper call:

import { DRT } from "@drttix/drt-sdk";

DRT.init({ apiKey: "your-api-key", shopperScope: "per-request" });

await DRT.shopper.product.addProduct(productBody, {
  shopperGuid: req.shopperGuid,
  accountId: req.accountId,
});

apiKey is still set once at init — it identifies your backend, not the shopper. shopperGuid/accountId are the only values that become per-request. Portal and scanner are unaffected and remain singleton-scoped.

The API key

DRT.init({ apiKey }) is mandatory (2.0.0). Every service call — shopper, portal and scanner alike — throws DRT SDK not initialized until it has run; there is no keyless mode. Portal-only and scanner-only consumers pass shopperScope: 'per-request' so no shopper credentials are needed at init.

The shopper API refuses every request that does not carry a live key in the apikey header, and only honours a key from the domains it was issued for (recital_ticketing.dbo.shopper_api_key). Keys look like drt_shopper_de1ab347f47c…. The convention across DRT services is to read it from the DRT_API_KEY environment variable (in Azure DevOps: the SDK variable group) and pass it to DRT.init:

DRT.init({ apiKey: process.env.DRT_API_KEY, shopperScope: "per-request" });

Browsers need nothing more: the browser sets the Origin header itself, and that is what the API matches against the key's allowed domains.

Servers (a Node backend, a script) send no Origin, so they must declare the domain they act as, which the SDK sends as x-drt-domain:

DRT.init({
  apiKey: process.env.DRT_API_KEY,
  domain: "tap-to-pay.drttix.com",
  shopperScope: "per-request",
});

A missing key, an unknown or deactivated key, or a domain the key does not allow all answer 401 with errorCode INVALID_API_KEY or API_KEY_DOMAIN_NOT_ALLOWED.

🛠️ Local Development (Developer Only)

For SDK contributors testing against a local API server:

// Option 1: Use localhost:3000
process.env.DRT_API_LOCAL = "true";

// Option 2: Use a custom base URL
process.env.DRT_API_BASE_URL = "http://localhost:8080";

import { DRT } from "@drttix/drt-sdk";

Or via command line:

# Use localhost:3000
DRT_API_LOCAL=true npx tsx test.ts

# Use custom base URL
DRT_API_BASE_URL=http://localhost:8080 npx tsx test.ts

Npm run generate Npm login Increment package.lock version Npm publish