Backend SDK

@dataira/node is an optional server-only wrapper around the REST API. Keep its API key in a secret manager; never import this package into a browser bundle.

The live demo uses this same server-to-browser token boundary with a dedicated demo Project, Environment, and datasource.

npm install @dataira/node

Mint an end-user token

import { Dataira } from "@dataira/node";

const dataira = new Dataira({
  apiKey: process.env.DATAIRA_API_KEY!,
  baseUrl: "https://api.dataira.ai",
});

const { token } = await dataira.createToken({
  endUserId: user.id,
  endUserOrgId: user.organizationId,
  datasourceId: "ds_123",
  scopeColumn: "account_id",
  scopeValue: user.accountId,
});

Your runtime API key already fixes the Partner organization, Project, and Environment. Dataira derives those values from the key; the browser or request body cannot override them. The token adds the end-user organization, end user, datasource, and row-level data scope. If your product has no organization model, omit endUserOrgId; it defaults to endUserId.

The first valid mint registers the user beneath that Partner and Environment. Later attempts to silently move the same Environment user to a different end-user organization are rejected. This prevents a key or token from reading assets outside its full identity scope.

Public SDK functions and JSON use camelCase. Database columns and JWT claims use snake_case; HTTP paths and package/file names use kebab-case.

Provision Projects and Environments

Use the tenant-level management credential from the Partner portal for this section. It may provision scopes and runtime keys, but it cannot mint end-user tokens itself.

const project = await dataira.projects.create("Acme Analytics");
const production = project.environments[0]; // created automatically
const staging = await dataira.projects.createEnvironment(project.id, {
  name: "Staging",
  slug: "staging",
});

Environments are optional beyond production. Use them when credentials, access policy, or end-user assets must be isolated between deployments.

Create an environment-scoped API key

const created = await dataira.apiKeys.create({
  name: "Acme production backend",
  projectId: project.id,
  environmentId: production.id,
});

storeSecret(created.token); // returned once

Both IDs are required and the Environment must belong to the Project. List and revoke keys with dataira.apiKeys.list() and dataira.apiKeys.revoke(id). Construct the token-minting Dataira client with created.token; that key is then fixed to the selected Project and Environment.

Backends in other languages can call the same /api/v1/embed/* endpoints directly; no Dataira backend SDK or Dataira-hosted user database is required.