---
id: docs.sdk
title: "The SDK"
canonical: https://docs.secureprocessing.app/sdk
last_verified: 2026-11-06
---

# The SDK

Zero dependencies, and the same file runs everywhere.

```bash
npm install @secureprocessing/node
```

Node 20+, Bun, Cloudflare Workers and Deno. It uses only `fetch` and Web Crypto, so there is nothing to polyfill and nothing to bundle.

## Deno and Supabase Edge Functions

Import it straight from us. The URL is pinned to a version and that version’s bytes never change, so the code you reviewed is the code that runs.

```ts
import { SecureProcessing } from "https://secureprocessing.app/sdk/0.2.6/index.js";

const sp = new SecureProcessing(Deno.env.get("SECURE_PROCESSING_KEY")!);
```

The types come with it: each file names its own declarations, so `deno check` and your editor see every type with no `@deno-types` line. If you are upgrading from 0.1.0, delete that line — it only ever typed the entry point.

On the Deno CLI this needs one flag, because Deno 2 only imports from hosts on its built-in allow-list unless you say otherwise:

```bash
deno run --allow-net --allow-env --allow-import=secureprocessing.app your-script.ts
```

> **Note:** 🔴 Served from our own infrastructure on purpose, and the flag is the price of that. The usual route for a Deno import is a public CDN that repackages npm — which is on Deno’s allow-list precisely because it is a well-known middleman, and which would sit in the path your payment code is fetched through at every deploy. For a library that moves money we would rather be the only party in that path and ask you for a flag.

## Options

```ts
new SecureProcessing(apiKey, {
  baseUrl: "https://api.secureprocessing.app",
  timeout: 30_000,
  maxRetries: 2,
  fetch: myFetch,     // a Worker's fetch, or a test double
});
```

> **Note:** Pin the version. We will not make a breaking change without a version bump, but a pinned import is the difference between a dependency you chose and one that changed under you.

## Without the SDK

It is an ordinary REST API and the SDK is a convenience. The [API reference](https://api.secureprocessing.app/reference) documents every endpoint, and the OpenAPI document behind it can generate a client in any language.