Configure credentials safely

Bearer tokens

Pass the raw token through an operation's auth option. The generated SDK adds the bearer scheme declared in OpenAPI.

1234567import { egovSso } from "egov.js";

const profile = await egovSso.authenticate({
  client,
  auth: accessToken,
  throwOnError: true,
});

For several calls with the same token, configure it on a dedicated client:

1234const authenticatedClient = createClient({
  auth: accessToken,
  baseUrl: serviceBaseUrl,
});

API keys

Configure API-key headers when creating a service client. Header names differ between providers and are documented by each operation in openapi.json.

123456const compass = createClient({
  baseUrl: compassBaseUrl,
  headers: {
    "X-API-Key": process.env.EGOVCOMPASS_API_KEY!,
  },
});

Other provider headers include X-EMESSAGE-Auth, X-eGovPay-Token, and X-EReport-View-Token.

Credential ownership

The generated SDK does not load environment variables or secrets. Applications must obtain credentials from their environment, vault, or platform binding and pass them through auth or headers.

Never expose partner secrets, API keys, or access tokens in browser code, public logs, screenshots, issue reports, or client-visible error payloads.