Configuration

import { AuraClient } from "@strangeworks/aura-sdk";

const aura = new AuraClient({ apiKey: process.env.AURA_API_KEY! });

Options

Option	Default	Does
apiKey	required	Your company API key (sk-aura-…), sent as Authorization: Bearer
baseUrl	https://aura.strangeworks.com	Which Aura to talk to
fetch	globalThis.fetch	The fetch implementation to use

The key is always explicit

The library reads nothing from the environment, so it can never pick up a credential you did not pass it. Reading process.env.AURA_API_KEY above is your code’s choice, not the SDK’s.

The CLI is the opposite: as a terminal tool it reads AURA_API_KEY and AURA_BASE_URL.

Bringing your own fetch

Any fetch-compatible function works, which is the seam for logging, retries, a proxy agent, or a test double:

const aura = new AuraClient({
  apiKey: process.env.AURA_API_KEY!,
  fetch: async (input, init) => {
    const started = Date.now();
    const response = await fetch(input, init);
    console.log(`${init?.method ?? "GET"} ${String(input)} → ${response.status} in ${Date.now() - started}ms`);
    return response;
  },
});

Uploads bypass it

deployFromFolder PUTs file bytes to the URL an upload plan returns, using only that plan’s headers — never your API key. Your fetch still sees the plan and completion calls.

Checking a key works

There is no dedicated ping; the cheapest real call is listing projects.

import { AuraApiError } from "@strangeworks/aura-sdk";

try {
  await aura.listProjects();
} catch (err) {
  if (err instanceof AuraApiError && err.status === 401) {
    throw new Error("AURA_API_KEY is missing or revoked");
  }
  throw err;
}