SDK

@digize/sdk is the typed way to call Digize from code. It’s one package with three entry points:

Import	What it’s for
@digize/sdk	A site’s own code, in its Worker and in the browser: the site’s identity, forms, the storefront and its reviews, and analytics events. No key: Digize knows which site is calling.
@digize/sdk/api	The public API at https://digize.com/api/v1 with a workspace API key, from a server. Every operation is a typed method.
@digize/sdk/webhooks	Checking the Digize-Signature on the webhooks a workspace sends, and reading their events.

It runs in Cloudflare Workers, current browsers and Node 22 or later, has no dependencies, and comes with its own TypeScript types.

Install

npm install @digize/sdk

pnpm add @digize/sdk and yarn add @digize/sdk work the same. In a site’s repository, add it to the site’s own package.json; the build bundles it with the rest of the Worker.

Caution

@digize/sdk isn’t on npm yet. These pages describe 0.1.0, its first release; until it’s published, call the platform paths and the API directly.

A first call

In a site’s Worker, read a product for its page:

src/index.ts

import { createSiteClient, handlePlatform } from "@digize/sdk";

export default {
  async fetch(request: Request): Promise<Response> {
    const platform = await handlePlatform(request);
    if (platform) return platform;

    const digize = createSiteClient({ request });
    const { product, store } = await digize.store.product("cold-brew");
    return new Response(`${product.name} from ${store.name}`);
  },
};

From a server with an API key, list contacts:

import { createApiClient } from "@digize/sdk/api";

const api = createApiClient({ apiKey: process.env.DIGIZE_API_KEY! });
for await (const contact of api.paginate("crm.contacts.page", { tag: ["vip"] })) {
  console.log(contact.name, contact.email);
}

In a webhook receiver, check a delivery before trusting it:

import { parseWebhook } from "@digize/sdk/webhooks";

const event = await parseWebhook(
  await request.text(),
  request.headers.get("digize-signature"),
  env.DIGIZE_WEBHOOK_SECRET,
);

How calls reach Digize

• A site’s Worker calls the platform paths under /_platform/ on its own hostname. Every fetch a site’s Worker makes goes through Digize’s Outbound Worker, which answers these paths itself, with the site’s identity from Digize’s router rather than from anything the site sends.
• A browser on the site calls the same paths on the page’s own hostname. That request reaches the site’s Worker like any other page, so the Worker passes it on with handlePlatform. A site without a Worker of its own gets this from Digize’s static site script.
• The API client calls https://digize.com/api/v1 with a workspace API key.
• Webhooks come to your endpoint, signed with the endpoint’s secret.

Caution

API keys are for servers. Never put one in a site’s pages or in code a browser downloads: the site client needs no key, and a key can do whatever its permissions allow across the whole workspace.

Next

Site clientcreateSiteClient in a Worker and in the browser, and handlePlatform.

FormsForm posts with Turnstile, and the errors to show beside each field.

StorefrontPage data, checkout, its status, and the reviews widget.

AnalyticsCustom events and page views through the tracker.

API clientEvery public API operation, typed, with retries and pages.

WebhooksVerifying Digize-Signature and reading events.

ErrorsDigizeError and its codes.