Skip to main content

​
SDK matrix

​
Choosing an SDK

Backend service

Use Go, Node.js, Python, .NET, Spring Boot, Kotlin, PHP, or Rust. Backend services use secret keys (backend services only) and have access to secrets, configs, and flags. Workload Identity Federation (WIF) is supported on all backend SDKs.

Frontend / browser

Use Angular, React, or Vue. Browser SDKs use public keys (browser/frontend, safe to expose) and have access to configs and flags only. Secrets are never sent to the browser.

​
Shared behaviour across all SDKs

All backend SDKs implement the same core contract:
  • TTL-based cache - initial sync populates the cache; background refresh keeps it current without blocking callers
  • ETag / 304 - unchanged data resets the TTL without re-downloading the full payload
  • SSE live updates - value changes propagate within milliseconds; falls back to TTL polling after 3 transport errors
  • 402 handling - when billing is blocked, background sync halts and the cached values are served until resolved
  • Quarantine handling - 429 with quarantine body pauses sync until expiresAt; stream reconnects without counting as a transport failure
  • Service kind enforcement - GetSecret is blocked with an error on kind=frontend services regardless of key type
  • Write API (v0.5.0) - SetSecret, DeleteSecret, DeleteSecretVersion on all backend SDKs; public keys are rejected before the network call

​
Versioning

The SDKs share a version line but do not all move together - a release goes out when that SDK has something to ship, so the numbers drift apart between rounds. The Latest column above is the current version of each; each SDK’s own page carries its changelog. Rust is still published as a beta (v0.10.1-beta.1); the stable release is deferred pending broader usage.
The PHP package (westyx/nexus) requires a Composer repository entry. See the PHP SDK installation guide for the full setup.