Management SDK

The public management client is coming soon. The current package is private, repo-owned tooling used by PokerWorks operators, the internal CLI, and the internal MCP server.

Install

The intended public package name is:

Code
@pokerworks/management

The current workspace package (@pokerworks/developer-api-management-client) is private and is not an external beta install path. Public npm distribution comes after the management API contract and packaging pipeline are proven.

Authenticate

The client takes a service-account management token (pw_mgmt_…). Use it only from trusted server code — never ship a management token to a browser or client app.

future public shape
import {
  createDeveloperApiManagementClient,
  DEVELOPER_API_BASE_URL_ENV,
  DEVELOPER_API_MANAGEMENT_TOKEN_ENV,
} from "@pokerworks/management";

const management = createDeveloperApiManagementClient({
  managementToken: process.env[DEVELOPER_API_MANAGEMENT_TOKEN_ENV]!,
  apiBaseUrl: process.env[DEVELOPER_API_BASE_URL_ENV],
});

apiBaseUrl defaults to https://api.pokerworks.io/api/v1. Production URLs must use HTTPS; local development may use localhost or 127.0.0.1.

Usage

Code
const { project } = await management.createProject({
  name: "Discord bot sandbox",
  allowedOrigins: ["https://example.com"],
});

const created = await management.createApiKey({
  projectId: project.id,
  environment: "test",
  label: "CI smoke key",
  scopes: ["calculations:read"],
});

// Store this immediately; it is never returned again.
await saveSecret(created.secret);

const usage = await management.usage({
  environment: "test",
  projectId: project.id,
  limit: 25,
});

const { launchUrl } = await management.createEmbedSession(
  {
    environment: "test",
    mode: "spectator",
    origin: "https://club.example.com",
    productKey: "pokerdeck-club-demo",
    projectId: project.id,
    target: { kind: "public_ring_product" },
  },
  { idempotencyKey: "embed-session-demo-1" },
);

await management.revokeApiKey(created.key.id);

The current internal method set is:

• account()
• listProjects()
• createProject(body)
• updateProject(projectId, body)
• listApiKeys()
• createApiKey(body)
• revokeApiKey(keyId)
• usage(query)
• billing()
• auditEvents(query)
• listEmbedProducts()
• createEmbedSession(body, options)
• getEmbedSession(embedSessionId)
• listWebhookEndpoints(query)
• createWebhookEndpoint(body)
• getWebhookEndpoint(endpointId)
• updateWebhookEndpoint(endpointId, body)
• rotateWebhookEndpointSecret(endpointId)
• deleteWebhookEndpoint(endpointId)
• listWebhookDeliveries(query)
• replayWebhookDelivery(deliveryId)

The client rejects browser runtimes and validates request/response bodies with the same schemas as the API. Reveal-once product keys, management tokens, embed launch secrets, and webhook signing secrets are redacted from client error text.

Related

• Service accounts & management tokens
• TypeScript SDK (calculation API)
• Recipes