Browsers and apps

An API key opens everything in its workspace, and anyone who runs your web page or app can read what you ship in it. So the SDK refuses to start in a browser, and the API doesn't take calls from a web page either: its CORS doesn't allow the Authorization header.

Call the API from your server, and have your frontend call your server:

import Swarmhit from '@swarmhit/swarmhit-sdk';

const swarmhit = new Swarmhit(); // your API key, on the server only

// e.g. GET /api/campaigns, behind your own login
export async function listCampaigns() {
  const page = await swarmhit.campaigns.list({ limit: 20 });
  return page.data.map((c) => ({ id: c.id, name: c.name, status: c.status }));
}

Return only what the page needs, and check in your endpoint that the user may see it.

Connecting senders and mailboxes from your app

Signing in to LinkedIn or to a mailbox happens on a page Swarmhit hosts. Your server creates a hosted connect link and sends the user to its url. The user comes back to your redirectUrl when they finish:

const link = await swarmhit.accounts.hostedLinks.create({
  redirectUrl: 'https://example.com/settings/linkedin',
});
// redirect the user to link.url

swarmhit.emailAccounts.hostedLinks.create(…) does the same for mailboxes. The account.connected webhook tells your server when a sender is ready.

Tests and proxies

dangerouslyAllowBrowser: true lets the client start in a browser-like runtime anyway: a test environment, or a page whose baseURL is your own proxy that adds the key on the server. Never use it to put an API key on a page anyone else can open.