Authentication and token refresh

import { initialize, type TokenRefreshResult } from "@expys/sdk";

const token = process.env.EXPYS_MEMBER_TOKEN;
if (!token) {
  throw new Error(
    "Set EXPYS_MEMBER_TOKEN (a member token from your backend's /v1/auth/exchange)",
  );
}

const refreshUrl = process.env.EXPYS_REFRESH_URL ?? "/api/expys/refresh";

// Calls your backend, which re-exchanges the Org-API-Key and returns a fresh
// token. Returning `expiresAt` re-arms proactive refresh for the next call.
async function refreshToken(): Promise<TokenRefreshResult> {
  const res = await fetch(refreshUrl, { method: "POST" });
  if (!res.ok) {
    // A thrown refresh propagates to your call as an ExpysError and is NOT retried.
    throw new Error(`refresh failed: ${res.status}`);
  }
  return res.json() as Promise<TokenRefreshResult>;
}

const expys = initialize({
  baseUrl: process.env.EXPYS_BASE_URL,
  environment: "live",
  // Refresh ~60s before expiry. Setting tokenExpiresAt enables proactive refresh;
  // omit it to rely solely on reactive (401) refresh.
  refreshSkewMs: 60_000,
  refreshToken,
  token,
  tokenExpiresAt: Date.now() + 5 * 60_000,
});

async function main(): Promise<void> {
  // If the token is within the skew window, the SDK refreshes before this call;
  // on a 401 it refreshes once and retries with the new token.
  const wallet = await expys.wallet();
  console.log(`wallet balance: ${wallet.balance}`);
}

import ExpysSDK
import Foundation

#if canImport(FoundationNetworking)
  import FoundationNetworking
#endif

/// Shape your backend's refresh endpoint returns. Decoded here (not in the SDK)
/// so the SDK stays transport-agnostic about your token plumbing.
private struct RefreshResponse: Decodable {
  let accessToken: String
  let expiresInSeconds: Double?
}

@main
struct TokenRefreshExample {
  static func main() async throws {
    let environment = ProcessInfo.processInfo.environment
    guard let token = environment["EXPYS_MEMBER_TOKEN"] else {
      fatalError("Set EXPYS_MEMBER_TOKEN (a member token from your backend's /v1/auth/exchange)")
    }
    let baseURL =
      environment["EXPYS_BASE_URL"].flatMap(URL.init(string:))
      ?? ExpysConfiguration.defaultBaseURL
    let refreshURL =
      environment["EXPYS_REFRESH_URL"].flatMap(URL.init(string:))
      ?? URL(string: "https://example.com/api/expys/refresh")!

    let client = ExpysClient(
      configuration: ExpysConfiguration(
        token: token,
        environment: .live,
        baseURL: baseURL,
        // Setting tokenExpiresAt enables proactive refresh; omit it to rely solely
        // on reactive (401) refresh.
        tokenExpiresAt: Date().addingTimeInterval(5 * 60),
        // Calls your backend, which re-exchanges the Org-API-Key. A thrown refresh
        // propagates to your call as an ExpysError and is NOT retried.
        refreshToken: {
          var request = URLRequest(url: refreshURL)
          request.httpMethod = "POST"
          let (data, response) = try await URLSession.shared.data(for: request)
          guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode)
          else {
            throw ExpysError.network("refresh failed")
          }
          let body = try JSONDecoder().decode(RefreshResponse.self, from: data)
          // Returning expiresAt re-arms proactive refresh for the next call.
          return TokenRefresh(
            accessToken: body.accessToken,
            expiresAt: body.expiresInSeconds.map { Date().addingTimeInterval($0) }
          )
        },
        // Refresh ~60s before expiry.
        refreshSkew: 60
      )
    )

    // If the token is within the skew window, the SDK refreshes before this call;
    // on a 401 it refreshes once and retries with the new token.
    let wallet = try await client.wallet()
    print("wallet balance: \(wallet.balance)")
  }
}

package com.expys.sdk.examples.tokenrefresh

import com.expys.sdk.ExpysClient
import com.expys.sdk.ExpysConfiguration
import com.expys.sdk.TokenRefresh
import kotlinx.coroutines.runBlocking

fun main() = runBlocking {
  val token = System.getenv("EXPYS_MEMBER_TOKEN")
    ?: error("Set EXPYS_MEMBER_TOKEN (a member token from your backend's /v1/auth/exchange)")

  val client = ExpysClient.create(
    ExpysConfiguration(
      token = token,
      tokenExpiresAtMs = System.currentTimeMillis() + 5 * 60_000,
      refreshSkewMs = 60_000,
      refreshToken = {
        // Call YOUR backend, which re-exchanges the Org-API-Key, and return a fresh
        // token. TokenRefresh is constructed, not decoded, so your payload shape is
        // your concern. This stub just reuses the env token for illustration.
        TokenRefresh(accessToken = token, expiresAtMs = System.currentTimeMillis() + 5 * 60_000)
      },
      baseUrl = System.getenv("EXPYS_BASE_URL") ?: ExpysConfiguration.DEFAULT_BASE_URL,
    ),
  )

  val wallet = client.wallet()
  println("balance: ${wallet.balance}")
}