
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
@freemius/sdk
Advanced tools
Monetize your SaaS or app backend faster: one lightweight, fully typed SDK for Checkout creation, pricing + plans, licenses, subscriptions, purchases, entitlements, and secure webhooks. Built for real-world production flows.
Looking for a step‑by‑step walkthrough of backend checkout generation, secure purchase validation, local entitlement storage, webhook‑driven license lifecycle syncing, and feature gating logic? Check out the guides below.
We also have the React Starter Kit you can use on your front-end to quickly render Checkout overlays, pricing tables, and a customer portal.
@freemius/sdk
?purchase.retrievePurchaseData()
, entitlement.getActive()
).npm install @freemius/sdk @freemius/checkout zod
Requires Node.js 18+ (or an Edge runtime supporting Web Crypto + standard fetch APIs). See the official documentation for full capability reference.
Go to the Freemius Developer Dashboard) and obtain the following:
productId
– Numeric product identifierapiKey
– API key (used as bearer credential)secretKey
– Secret key used for signing (HMAC) and secure operationspublicKey
– RSA public key for license / signature related verification flowsStore these in your environment variables, e.g. in a .env
file:
FREEMIUS_PRODUCT_ID=12345
FREEMIUS_API_KEY=...
FREEMIUS_SECRET_KEY=...
FREEMIUS_PUBLIC_KEY=...
Now initialize the SDK:
import { Freemius } from '@freemius/sdk';
export const freemius = new Freemius({
productId: Number(process.env.FREEMIUS_PRODUCT_ID),
apiKey: process.env.FREEMIUS_API_KEY!,
secretKey: process.env.FREEMIUS_SECRET_KEY!,
publicKey: process.env.FREEMIUS_PUBLIC_KEY!,
});
async function getUserByEmail(email: string) {
const user = await freemius.api.user.retrieveByEmail(email);
// user has typed shape matching Freemius API spec
return user;
}
See also api.product
, api.license
, api.subscription
, api.payment
, api.user
, etc.
Construct a hosted checkout URL or
retrieve overlay options (pair with
@freemius/checkout
on the client):
const checkout = await freemius.checkout.create();
checkout.setCoupon({ code: 'SAVE10' });
checkout.setTrial('paid');
const hostedUrl = checkout.getLink(); // Redirect user or generate email link
const overlayOptions = checkout.getOptions(); // Serialize & send to frontend for modal embed
Retrieve pricing metadata (plans, currencies, etc.):
async function fetchPricing() {
return await freemius.pricing.retrieve();
}
Use this to create your own pricing table on your site.
Listen for and securely process webhook events. Example using Node.js HTTP server:
import { createServer } from 'node:http';
const listener = freemius.webhook.createListener();
listener.on('license.created', async ({ objects: { license } }) => {
// Persist or sync license state in your datastore
console.log('license.created', license.id);
});
const server = createServer(async (req, res) => {
if (req.url === '/webhook' && req.method === 'POST') {
await freemius.webhook.processNodeHttp(listener, req, res);
} else {
res.statusCode = 404;
res.end('Not Found');
}
});
server.listen(3000, () => {
console.log('Webhook listener active on :3000');
});
Resolve purchase data or validate entitlement status:
async function retrievePurchase(licenseId: number) {
const purchase = await freemius.purchase.retrievePurchase(licenseId);
if (!purchase) throw new Error('Purchase not found');
return purchase;
}
const purchase = await retrievePurchase(123456);
if (purchase) {
db.entitlement.insert(purchase.toEntitlementRecord());
}
async function getActiveEntitlement(userId: number) {
const entitlements = await db.entitlement.query({ userId, type: 'subscription' });
return freemius.entitlement.getActive(entitlements);
}
Backend Use Only
Never initialize the SDK in browser / untrusted contexts. The
secretKey
andapiKey
are privileged credentials.
Happy shipping. ⚡
MIT © Freemius Inc
Payments, tax handling, subscription lifecycle management, and licensing are abstracted so you can focus on product functionality rather than billing infrastructure.
FAQs
JS SDK for integrating your SaaS with Freemius
The npm package @freemius/sdk receives a total of 13 weekly downloads. As such, @freemius/sdk popularity was classified as not popular.
We found that @freemius/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.