Guides
Authentication
How the TypeScript client authenticates, and how key verification works.
TawaGuard.create(apiKey) reads your key from the argument you pass it (or
wherever you source TAWA_API_KEY from) and authenticates before
returning — a bad key surfaces at construction time, as a thrown
FetchError, rather than on the first scan call:
import { TawaGuard, FetchError } from "@tawaguard/sdk";
try {
const tawa = await TawaGuard.create(process.env.TAWA_API_KEY!);
} catch (err) {
if (err instanceof FetchError && err.status === 401) {
// bad or revoked key
}
}Keep your secret key server-side. Don't ship it to the browser or commit it.
Managing keys
Create and revoke API keys from the dashboard under Settings → API keys.
Calling the API without the SDK, or need the raw /verify endpoint and
error shape? See Authentication in the API
Reference.