Skip to main content

Point the @fetchski scope at your site

Your own site serves the @fetchski packages, and any API key from it lets you in. In your project’s folder (beside its package.json), make a file named .npmrc holding these two lines:
.npmrc
The first line says @fetchski packages come from your site; the second is the key to sign in with. Put your site’s address in both lines (set your site in the bar under this page’s title and the example shows it), and paste your whole key in place of fsk_acme_…. Write the key itself, never a variable or a value from .env: npm and pnpm don’t read .env, and pnpm refuses a variable here.
Any API key from your site works, the same one your app uses included: its scopes and signing mode don’t matter for installing, only that it’s switched on and not past its expiry date. No key yet? Make one in the CMS under API Keys (Authentication).
Then keep the file out of git. Add this line to the project’s .gitignore (make the file if there isn’t one):
.gitignore
.npmrc now holds a key to your site: never commit it. If git already tracks a .npmrc, stop tracking it with git rm --cached .npmrc. Keep these lines in this project’s .npmrc only, never in the .npmrc in your home folder. In CI, write the same file from a secret before installing.

Install

In a terminal, in the same folder as the .npmrc, run the line for the package manager your project uses:
401 Unauthorized? Your site refused the key in .npmrc: it’s mistyped or cut short, switched off, or past its expiry date. Check too that .npmrc sits in the folder you ran the command in.
A release on its first day: pnpm 11 skips any package published less than a day ago, so an install picks the release before it. Exempt the @fetchski packages to take each one at once:
pnpm-workspace.yaml

Give your coding agent the skill

The package’s Agent Skill, installed for the agents you pick, so they call the SDK the way these guides do.

Requirements

Runtimes

Node 26.12.1+, Bun, and browsers with AbortSignal.any (Chrome 116, Firefox 124, Safari 17.4).

TypeScript

5.4 and later, under nodenext, node16 or bundler resolution.

No dependencies

Only fetch and Web Crypto. ES modules; require() works on Node 26.12.1+ and Bun.

Other setups

CI installs the same way: before the install, write the same .npmrc from a secret holding one of your site’s API keys. In GitHub Actions, with the key in a repository secret named ATTRACT_PACKAGES_KEY:
.github/workflows/ci.yml
It weighs about half a megabyte minified: every method comes with the client. Never ship an API key or signing secret to a browser.
require('@fetchski/attract-cms-sdk') works on Node 26.12.1+ and Bun. TypeScript before 5.8 refuses that import in a CommonJS file (TS1479): use ES modules there, or a newer TypeScript.

Next: configuration

Zero-config from the environment, or options.