Rust SDK - Configuration

use westyx_nexus::{NexusClient, NexusConfig};
use std::time::Duration;

let client = NexusClient::create(NexusConfig {
    api_key: std::env::var("NEXUS_API_KEY")?,
    endpoint: "https://blue-ocean-a5rx7.api.westyx.dev".to_string(),
    ttl: Some(Duration::from_secs(60)),
    ..Default::default()
})
.await?;

NexusConfig implements Default, so build it with ..Default::default() - a new option in a later release then does not touch your call site.

Options

Option	Type	Default	Description
`api_key`	`String`	required*	The secret key (`wxs_...`) or public key (`wxp_...`)
`endpoint`	`String`	required	Full service endpoint URL, e.g. `https://blue-ocean-a5rx7.api.westyx.dev`. Must be `https` unless the host is loopback
`ttl`	`Option<Duration>`	60 s	How long the snapshot is served before a background refresh is triggered. Minimum 1 s
`wif`	`Option<WifConfig>`	`None`	Workload Identity Federation - see Workload identity
`sse_reconnect_cooldown`	`Option<Vec<u64>>`	`[5, 10, 20, 40, 60]` min	Schedule for retrying SSE after falling back to TTL polling. Unit: minutes. One element = a fixed interval; several = a schedule that stays at the last value. An empty vector uses the default

*api_key may be empty when wif.enabled = true.

Validation happens once, at construction

Every option is resolved and checked before the client exists. A rejection names the option and, for list options, the index - so the mistake is visible immediately instead of resurfacing days later as unexplained load or a stalled stream:

invalid configuration: `ttl` is 0ns, which is below the 1s minimum - a zero or
sub-second TTL makes every read trigger a refresh

invalid configuration: `sse_reconnect_cooldown[1]` is 0 minutes - a zero cooldown
reconnects in a tight loop; the minimum is 1

invalid configuration: `endpoint` must use https (got http://svc.example.com) -
plain http is allowed only for localhost/loopback

Rejected values: an empty endpoint, an unparseable URL, a URL with no host, plain http on a non-loopback host, no credential at all, a ttl under one second, a 0 cooldown entry, and a cooldown above 24 hours.

Endpoint URL

https://blue-ocean-a5rx7.api.westyx.dev   <- production
http://localhost:3000                      <- local development only

The SDK sends the host as the Host header on every request (Double-Gate validation).

Choosing a TTL

Use case	Recommended TTL
Feature flags that change frequently	30 s
Standard config and secrets	60 s (default)
Stable secrets rarely rotated	5 min
Boot-time-only values	1 h

With run_stream() active, events keep the cache fresh and the timer acts as a fallback - the configured interval still applies exactly as set.

Keeping the key secure

api_key: std::env::var("NEXUS_API_KEY").expect("NEXUS_API_KEY not set"),

NexusClient implements Debug with the credential redacted, so logging the client cannot leak it. The SDK’s own tracing output never carries a key, a token, a secret value or even a secret’s key name.

WifConfig

Option	Type	Default	Description
`enabled`	`bool`	`false`	Turns WIF on
`credential`	`WifCredential`	`Provider(WifProvider::Auto)`	Either `Provider(WifProvider)` - `Auto` \| `Kubernetes` \| `Aws` \| `AwsIam` \| `Gcp` \| `Azure` \| `Developer` - or `Source(Arc<dyn WifCredentialSource>)`. One field, so a provider and a custom source cannot both be set
`audience`	`Option<String>`	`westyx-nexus`	On the Azure IMDS path it MUST be `api://<client-id>`; the generic default is refused
`aws_region`	`Option<String>`	AWS chain	STS region for `aws_iam`

WifConfig also implements Default.

Timeouts and limits

These are not configurable; they are chosen to match the backend’s behaviour.

Setting	Value
Request deadline (sync, writes, AB, token exchange)	10 s
Connect deadline	5 s
Connection pool idle lifetime	60 s
SSE idle deadline (resets on every byte, keepalives included)	90 s
Metadata / IMDS deadline	2 s
Body cap: sync and AB evaluation	8 MiB
Body cap: token exchange	1 MiB
Body cap: metadata / IMDS	64 KiB
SSE single-line cap	64 KiB
Session refresh window before expiry	60 s
Billing (402) back-off	5 min
Quarantine cap	24 h

Overview

Backend SDKs

Browser SDKs

OpenFeature Providers

Rust SDK - Configuration

Options

Validation happens once, at construction

Endpoint URL

Choosing a TTL

Keeping the key secure

WifConfig

Timeouts and limits

​Options

​Validation happens once, at construction

​Endpoint URL

​Choosing a TTL

​Keeping the key secure

​WifConfig

​Timeouts and limits

Options

Validation happens once, at construction

Endpoint URL

Choosing a TTL

Keeping the key secure

WifConfig

Timeouts and limits