PraxaClient is a trusted-server client for the Integration Gateway. Its
credential is a short-lived delegated OAuth token, not a personal Execution
Fabric API key and not a provider credential.
Credential decision table
Do not substitute one credential for another. A token that authenticates one
plane does not grant authority in another.
Configure an exact Gateway origin
ThebaseUrl must be an HTTPS origin with no path, query, fragment, username,
or password.
Supply renewable tokens
The SDK invokes your provider before every request. Cache the token only until shortly before expiry and serialize refreshes so one expiry does not trigger a refresh stampede.exchangeApplicationSessionForPraxaToken() is deployment-specific. It should
validate the application principal, requested tenant, audience, scopes,
consent, and expiry at the issuing authority. Do not accept those authority
fields directly from an untrusted browser body.
Bound each operation
Pass anAbortSignal to stop work when the caller disconnects or your local
deadline expires:
Configure retries deliberately
Add redacted request telemetry
Inject a wrapper aroundfetch to record method, host, route family, status,
latency, and request correlation. Never log authorization headers, request
bodies, memory text, provider payloads, or webhook secrets.
Pin the package contract in CI
Browser and mobile boundary
The application frontend should receive only the projection it needs. Keep Gateway errors, identifiers, and traces redacted according to your product’s data policy.Production checklist
- Rotate and revoke tokens at the issuing authority.
- Request only the scopes required by the code path.
- Derive tenant and subject from the authenticated application principal.
- Persist the idempotency key with the request body before the first mutation.
- Bound connect, operation, and overall request time.
- Redact authorization, bodies, memory, traces, and provider data from logs.
- Alert on repeated
401,403,409,429, and retry exhaustion separately. - Prove cross-tenant denial and revoked-token behavior with disposable fixtures.
Troubleshoot SDK integrations
Diagnose origin validation, OAuth, scopes, retries, SSE reconnects, package
imports, and contract mismatches.