Skip to main content

Node.js SDK

Node.js applications use the Keeptrusts OpenAI-compatible endpoint instead of calling an upstream provider directly. The gateway owns provider credentials; the application sends a separate Keeptrusts client token.

Prerequisites​

  • Node.js 18 or later.
  • The kt CLI.
  • A Keeptrusts runtime API token for the gateway and a separate gateway key, access key, or personal API token for the application.
  • An upstream model ID and credential from the provider you configure.

Configure and start the gateway​

Replace the model placeholder before starting the gateway.

pack:
  name: node-sdk-integration
  version: 1.0.0
  enabled: true
policies:
  chain:
    - prompt-injection
    - pii-detector
    - audit-logger
providers:
  targets:
    - id: openai-primary
      provider: openai
      model: "replace-with-openai-model-id"
      base_url: https://api.openai.com
      secret_key_ref:
        env: KEEPTRUSTS_OPENAI_API_KEY
export KEEPTRUSTS_API_TOKEN="replace-with-keeptrusts-api-token"
export KEEPTRUSTS_OPENAI_API_KEY="replace-with-openai-api-key"

kt policy lint --file policy-config.yaml
kt gateway run \
  --agent node-sdk-integration \
  --listen 127.0.0.1:41002 \
  --policy-config policy-config.yaml

The --agent flag is required with --policy-config and uses KEEPTRUSTS_API_TOKEN to synchronize the agent-bound configuration. Do not reuse that runtime token as the application credential.

OpenAI SDK​

Install the official SDK:

npm install openai
export KEEPTRUSTS_CLIENT_TOKEN="replace-with-separate-client-token"

Create the client with the Keeptrusts URL and token:

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env.KEEPTRUSTS_CLIENT_TOKEN,
  baseURL: 'http://127.0.0.1:41002/v1',
});

const response = await client.chat.completions.create({
  model: 'replace-with-openai-model-id',
  messages: [{role: 'user', content: 'Reply with one short sentence.'}],
});

console.log(response.choices[0]?.message?.content);

Do not place either token in browser-delivered JavaScript. Call Keeptrusts from a server route or backend process.

Native fetch​

Node.js 18 and later can call the gateway without an SDK:

const response = await fetch(
  'http://127.0.0.1:41002/v1/chat/completions',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.KEEPTRUSTS_CLIENT_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      model: 'replace-with-openai-model-id',
      messages: [{role: 'user', content: 'Summarize this request.'}],
    }),
  },
);

if (!response.ok) {
  throw new Error(`Keeptrusts returned ${response.status}: ${await response.text()}`);
}

console.log(await response.json());

Streaming​

Use streaming only after confirming that the selected provider, model, request family, and policy chain support it:

const stream = await client.chat.completions.create({
  model: 'replace-with-openai-model-id',
  messages: [{role: 'user', content: 'Write two short lines.'}],
  stream: true,
});

for await (const event of stream) {
  process.stdout.write(event.choices[0]?.delta?.content ?? '');
}

Do not assume that every policy can rewrite partial output chunks. Validate the complete flow before production rollout.

Operational guidance​

  • Keep the OpenAI SDK baseURL ending in /v1; the raw HTTP example includes the complete route.
  • Use the same model ID as the configured target unless an explicit route maps the request elsewhere.
  • Treat provider pricing, context windows, and model availability as mutable vendor facts.
  • Handle non-2xx responses before parsing a success body.
  • Set application-level timeouts appropriate to your request and deployment.

Next steps​