Skip to main content
PraxaClient is a trusted-server client for the Integration Gateway. Its credential is a short-lived delegated OAuth token, not a personal Execution Fabric API key and not a provider credential.

Credential decision table

Do not substitute one credential for another. A token that authenticates one plane does not grant authority in another.

Configure an exact Gateway origin

The baseUrl must be an HTTPS origin with no path, query, fragment, username, or password.
Use the Gateway origin supplied by your Praxa deployment. The public package does not discover or provision that origin.

Supply renewable tokens

The SDK invokes your provider before every request. Cache the token only until shortly before expiry and serialize refreshes so one expiry does not trigger a refresh stampede.
exchangeApplicationSessionForPraxaToken() is deployment-specific. It should validate the application principal, requested tenant, audience, scopes, consent, and expiry at the issuing authority. Do not accept those authority fields directly from an untrusted browser body.

Bound each operation

Pass an AbortSignal to stop work when the caller disconnects or your local deadline expires:
Aborting the HTTP request does not prove the server operation did not happen. For mutations, read back by run ID or replay the same body with the same idempotency key.

Configure retries deliberately

The SDK retries safe reads and replay-safe keyed requests. It does not replay unkeyed mutations. Keep local request deadlines larger than the complete retry budget, and measure attempts rather than counting a retry as a second logical operation.

Add redacted request telemetry

Inject a wrapper around fetch to record method, host, route family, status, latency, and request correlation. Never log authorization headers, request bodies, memory text, provider payloads, or webhook secrets.

Pin the package contract in CI

Review the changelog and your exact method usage before updating the expected fingerprint. Aura-compatible wire values remain stable public contract values; do not rewrite them in proxies or tool registries.

Browser and mobile boundary

The application frontend should receive only the projection it needs. Keep Gateway errors, identifiers, and traces redacted according to your product’s data policy.

Production checklist

  • Rotate and revoke tokens at the issuing authority.
  • Request only the scopes required by the code path.
  • Derive tenant and subject from the authenticated application principal.
  • Persist the idempotency key with the request body before the first mutation.
  • Bound connect, operation, and overall request time.
  • Redact authorization, bodies, memory, traces, and provider data from logs.
  • Alert on repeated 401, 403, 409, 429, and retry exhaustion separately.
  • Prove cross-tenant denial and revoked-token behavior with disposable fixtures.

Troubleshoot SDK integrations

Diagnose origin validation, OAuth, scopes, retries, SSE reconnects, package imports, and contract mismatches.
Last modified on August 14, 2026