SDKs

The Node.js SDK wraps the server API and does webhook and receipt verification for you. SDKs for Flutter, React Native and Python are planned. Until they ship, every SDK feature is available over plain HTTPS.

Node.js#

npm install @optproof/node

The SDK runs on Node.js 20 or later, has TypeScript types, and works in ESM and CommonJS projects.

import { OptProof } from '@optproof/node';​const optproof = new OptProof({ secretKey: process.env.OPTPROOF_SECRET_KEY });

record()#

Records consent captured in your own UI. Same fields as POST /v1/consents.

const { principalRef, receipts } = await optproof.record({  propertyId: 'prp_01JBTT8000E008000000000002',  principal: { email: 'asha@example.in' },  decisions: [    { purposeKey: 'account', granted: true },    { purposeKey: 'product_updates', granted: false },  ],  noticeVersion: 3,  idempotencyKey: `signup-${user.id}`,});

check()#

Returns whether a purpose is currently granted. Call it before any marketing send.

const { granted } = await optproof.check({  propertyId: 'prp_...',  purpose: 'whatsapp_reminders',  phone: '+919876543210',});if (!granted) return; // do not send

link()#

Merges a browser's device history into a known person, after they log in or submit a form.

await optproof.link({ propertyId: 'prp_...', deviceRef: req.body.optproof_device, principal: { phone } });

verifyWebhook()#

Checks the OptProof-Signature header against the raw request body. See Webhooks.

const result = optproof.verifyWebhook({  body: req.body, // raw bytes, not parsed JSON  signature: req.header('OptProof-Signature'),  secret: process.env.OPTPROOF_WEBHOOK_SECRET,});if (!result.valid) return res.status(400).send('Invalid signature');

verifyReceipt()#

Verifies a receipt offline against OptProof's published signing keys, and optionally checks it against the ledger and the daily anchor. This runs the same checks as verify.optproof.in, described in Receipts and verification.

const result = await optproof.verifyReceipt('eyJhbGciOiJFZERTQSIs...');// result.status: 'verified' | 'pending_anchor' | 'failed'// result.checks: [{ id: 'receipt_signature', result: 'pass' }, ...]

Errors#

Failed calls throw an OptProofError with the API's code, message, status and requestId. Retries for network errors and 5xx responses reuse the idempotency key, so a retried record() never writes twice.

Flutter Phase 3#

A consent sheet widget that renders your published notice natively, plus an API client. It will record consent with channel: "app" and show the receipt code in the app.

React Native Phase 3#

A component and hooks (useConsent, useReceipt) for React Native apps, with the same behaviour as the web widget's JavaScript API.

Python Phase 3#

A server-side client for Django, Flask and FastAPI backends with record, check, link, webhook verification and receipt verification. Until it ships, use the HTTP API and the webhook verification snippet in Python from the Webhooks page.