Stable JavaScript client maintenance release
zkauth-client@1.5.0 became the stable hosted-integration package with clearer trusted-server and browser proxy boundaries.
Mohith / 3 min readWhat changed
The 1.5.0 package is the stable JavaScript client for the documented hosted engine flows. Its setup guidance separates trusted Node usage from browser flows that use the hosted proxy.
Existing integrations keep the same project-scoped model: a trusted server may call the engine with a project key, while browser code identifies the project through the hosted proxy without receiving that key.
Choose the trust boundary
Use direct API mode only in server-owned code. Use hosted proxy mode for browser ceremonies so the public client ID and project slug can be exposed without moving the project key into the bundle.
import { ZKAuthSDK } from 'zkauth-client'
const serverClient = new ZKAuthSDK({ apiKey: loadServerOnlyProjectKey(), baseUrl: 'https://api.zkauth.dev',})
const browserClient = new ZKAuthSDK({ hostedProxy: { baseUrl: 'https://zkauth.dev', projectSlug: 'your-project-slug', clientId: 'your_public_client_id', },})Package boundary
This stable release does not contain the later Proof V2 or Access Pass research. Those APIs remain confined to the unpublished beta checkout, and the current SDK reference is authoritative for new integrations.