
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@botparty/sdk
Advanced tools
Client SDK for BotParty — federated bot identity, authentication, and payments.
Zero config. One function. Your bot gets an identity, rotates its keys, and authenticates on any BotParty-compatible server automatically.
npm install @botparty/sdk
import { botpartyFetch } from '@botparty/sdk';
// That's it. First call auto-registers a namespace and generates a keypair.
const res = await botpartyFetch('https://api.example.com/data');
const data = await res.json();
On first run, the SDK:
brave-fox-a3f2 on the BotParty server~/.botparty/On every call, it:
Authorization: Bearer <jwt>BotParty-compatible servers return typed errors that the SDK catches and throws as specific error classes. Each error has a code, message, and optional actionUrl for human intervention.
import {
botpartyFetch,
NamespaceLockedError,
PaymentRequiredError,
InsufficientPermissionError,
LinkRequiredError,
} from '@botparty/sdk';
try {
const res = await botpartyFetch('https://api.example.com/data');
} catch (err) {
if (err instanceof NamespaceLockedError) {
console.log('Namespace locked! Human must unlock at:', err.actionUrl);
}
if (err instanceof PaymentRequiredError) {
console.log('Payment needed:', err.message, err.actionUrl);
}
if (err instanceof InsufficientPermissionError) {
console.log('Missing scopes:', err.missingScopes);
}
if (err instanceof LinkRequiredError) {
console.log('Link a human account at:', err.actionUrl);
}
}
Use BotPartyClient for full control over registration, key management, and namespace operations.
import { BotPartyClient } from '@botparty/sdk';
const client = new BotPartyClient({
serverUrl: 'https://id.botparty.club', // default
algorithm: 'EdDSA', // default (also supports ES256)
rotationTTL: 15, // minutes, default
});
// Register with a custom name
await client.register('my-cool-bot', 'My Cool Bot');
// Or let it auto-register
await client.ensureRegistered();
// Generate a JWT token (handles registration + rotation automatically)
const token = await client.generateToken();
// Authenticated fetch
const res = await client.fetch('https://api.example.com/data');
// Check identity
const me = client.whoami();
// { namespace: 'my-cool-bot', keyId: 'key_...', staleAt: '...', ... }
// List all keys
const keys = await client.keys.list();
// Add a delegated key
await client.keys.add({
publicKey: '-----BEGIN PUBLIC KEY-----\n...',
scopes: ['mongo://production/*:read'],
rotationTTL: 60,
});
// Rotate the current machine's key
await client.keys.rotateCurrent();
// Fluent key operations
const key = client.key('key_abc123');
await key.info();
await key.update({ label: 'Updated label' });
await key.invalidate('Suspected compromise');
await key.delete();
// Get namespace info from server
const info = await client.info();
// { namespace: '...', status: 'active', linked: true, activeKeys: 2, ... }
// Generate a link URL for a human to claim ownership
const { url } = await client.link();
console.log('Share this with your human:', url);
// Destroy namespace (irreversible)
await client.destroy();
// Clear local state only
client.reset();
| Option | Env Variable | Default | Description |
|---|---|---|---|
serverUrl | BOTPARTY_SERVER_URL | https://id.botparty.club | BotParty server URL |
stateDir | BOTPARTY_STATE_DIR | ~/.botparty | Local state directory |
algorithm | — | EdDSA | Key algorithm (EdDSA or ES256) |
rotationTTL | — | 15 | Key rotation TTL in minutes |
The SDK stores identity and keys in ~/.botparty/:
~/.botparty/
├── identity.json # namespace, keyId, algorithm, rotatedAt, etc.
└── private.pem # Ed25519/EC private key (mode 0600)
| Class | Code | HTTP | Description |
|---|---|---|---|
BotPartyError | varies | varies | Base error class |
NamespaceLockedError | NAMESPACE_LOCKED | 423 | Namespace locked, human must unlock |
PaymentRequiredError | PAYMENT_REQUIRED | 402 | Payment needed for this action |
InsufficientPermissionError | INSUFFICIENT_PERMISSION | 403 | Missing required scopes |
LinkRequiredError | LINK_REQUIRED | 403 | Must link a human account |
All errors have .code, .message, .statusCode, and .actionUrl (when applicable).
MIT
FAQs
Client SDK for BotParty — federated bot identity, authentication, and payments
The npm package @botparty/sdk receives a total of 30 weekly downloads. As such, @botparty/sdk popularity was classified as not popular.
We found that @botparty/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.