Server SDKs

Server SDKs are trusted backend libraries. They hold app secrets, sign HTTP requests, sign private and presence channel auth responses, validate webhooks, publish realtime events, and manage push notifications.

Official SDKs

What belongs on the server

• event publishing and batch publishing
• idempotency keys for safe retries
• private, presence, encrypted, and user authentication
• webhook signature validation
• history, versioned messages, annotations, and presence history reads
• push device registration, channel push subscriptions, provider credentials, publish, scheduling, status, and delivery callbacks

Push as a backend concern

Client apps may collect device tokens, but server SDKs should register devices and publish push notifications. This keeps app secrets and provider credentials away from browsers and mobile apps.

await sockudo.publishPush({
  recipients: [{ type: "channel", channel: "orders" }],
  payload: {
    title: "Order updated",
    body: "Order ord_123 is packed",
  },
  idempotency_key: "push-order-ord_123-packed",
});

Shared production pattern

1. Instantiate one SDK client per process and reuse it.
2. Use environment variables or secret managers for app credentials.
3. Add idempotency_key to retryable publish and push workflows.
4. Validate private and presence channel access before signing.
5. Validate webhook signatures before parsing business logic.
6. Treat push publish responses as admission records and inspect status asynchronously.