# Official SDK (Node.js / TypeScript)

> @entrybit/sdk is the official TypeScript SDK for the EntryBit API — guest passes, the member directory, facilities and OAuth, fully typed, with retries, timeouts and zero runtime dependencies.

**`@entrybit/sdk`** is the official EntryBit SDK for Node.js and TypeScript. It covers the whole [REST API](/docs/api-reference/passes/) — guest passes, the member directory, facilities, and the [OAuth token lifecycle](/docs/oauth/overview/) — typed end to end from the published OpenAPI spec, with retries, timeouts, cancellation and typed errors built in.

Latest release: <a href="https://github.com/entrybit-hq/entrybit-sdk-js/releases/latest"><code data-sdk-version>v0.2.1</code></a> · [GitHub](https://github.com/entrybit-hq/entrybit-sdk-js) · [npm](https://www.npmjs.com/package/@entrybit/sdk) · [Changelog](https://github.com/entrybit-hq/entrybit-sdk-js/blob/main/CHANGELOG.md)

<script>
  fetch('https://api.github.com/repos/entrybit-hq/entrybit-sdk-js/releases/latest')
    .then((r) => (r.ok ? r.json() : null))
    .then((rel) => {
      const el = document.querySelector('[data-sdk-version]');
      if (el && rel && rel.tag_name) el.textContent = rel.tag_name;
    })
    .catch(() => {});
</script>

## Install

```bash
npm install @entrybit/sdk
```

Node.js 20.19+ (uses the built-in `fetch`); Cloudflare Workers, Deno and edge runtimes work wherever a WHATWG `fetch` exists. TypeScript 5.1+ for the bundled types. Zero runtime dependencies.

## Quickstart

Create an [API key](/docs/api-keys/overview/) in **Settings → API keys**, export it as `ENTRYBIT_API_KEY`, and the client picks it up automatically:

```ts
import { EntryBit } from "@entrybit/sdk";

const entrybit = new EntryBit(); // reads ENTRYBIT_API_KEY

// Walk the member directory (cursor pagination handled for you)
for await (const member of entrybit.org.members.iterate({ fields: ["name", "department"] })) {
  console.log(member.name);
}

// Create a guest pass — delivered to the guest by email and/or SMS
const created = await entrybit.org.passes.create({
  first_name: "Dana",
  email: "dana@example.com",
  arrival_date: "2026-08-12",
  facility_id: 1,
});
```

Acting on behalf of a signed-in user instead? Pass an [OAuth access token](/docs/oauth/overview/) — `new EntryBit({ getAccessToken: () => tokenStore.current() })` — and the SDK refreshes per attempt, single-flighted across concurrent requests.

## What you get

- **Typed end to end** — request params, responses and errors generated from the [OpenAPI spec](/docs/api-reference/openapi/), plus an ergonomic handwritten layer.
- **Resilience built in** — automatic retries with jittered backoff on `429`/`5xx` (honoring `Retry-After`), per-request timeouts, `AbortSignal` cancellation.
- **Typed errors** — `PermissionError` tells you the missing scope, `RateLimitError` the wait, and every failure is an `instanceof`-matchable class.
- **OAuth lifecycle included** — code exchange, refresh-token rotation, revocation, introspection and UserInfo via `entrybit.oauth`.
- **Transparent by default** — no analytics or phone-home; the one runtime-info header is documented and disabled with `telemetry: false`.

The [README on GitHub](https://github.com/entrybit-hq/entrybit-sdk-js#readme) is the full reference — every option, resource, error class and code sample (all samples are typechecked in the SDK's CI).

## Other platforms

Every other platform is covered by the standards EntryBit is built on: use any OAuth 2.0 / OIDC library for sign-in and generate a typed client from the OpenAPI spec — see [Libraries](/docs/resources/libraries/).