@peridotvault/pid-sdk-js) wraps the API for browsers. It sends credentials with every
request, so the API’s cookies are handled automatically.
Install
Initialize
clientId is applied to login, exchange, and fiat calls
automatically. The environment is auto-detected: NODE_ENV === 'production' →
production, everything else (unset, development, staging, test, …) →
sandbox. The API origin, popup host, Solana RPC, and program id all resolve from
there — chains come from the API registry, not your config.
- Force an environment for a staging build with
env: 'sandbox'. - Self-host / localhost: pass advanced
baseUrl(andpopupBaseUrl). - Server-side only: pass
clientSecret(used byauth.exchange) — never in browser code.
Sign in
auth.login() resolves the Google OAuth URL — navigate to it. The user signs in and is sent back to
CLIENT_SUCCESS_URL with the session cookies already set — or, for a new credential,
to the PID picker (?claim=1), where they choose the permanent <handle>@pid
(check auth.pidAvailable(handle) first; the handle can never be changed, reused,
or reassigned):
Identity
Login credentials
false) — every identity must
keep at least one way to log in.
Profile
pid, e.g. ifal@pid) is permanent and immutable — only the mutable
labels above can be updated. There is no endpoint that changes, reuses, or reassigns it.
Wallet
Each identity owns one personal wallet — its chain rows (Solana smart account- EVM counterfactuals), all derived from the PID. Custody is record-only: Peridot never generates, holds, or returns any key material.
- Creating again returns the existing wallet — a PID can never have more than one.
- The wallet belongs to the PID, not to Google (or any other provider). Unlinking a credential leaves it untouched, and logging in from another device does not change it.
createreturns the API error object on validation failure (400).
Money (fiat)
peridot.fiat covers top-up, balance, statement, and sends on the internal IDR
ledger. Full guide: Fiat & payments.
checkoutDeposit,transferViaPopup, andtransferConfirmare trust-critical: in popup mode they run on the PeridotID origin (see Popup flow).- Fiat methods throw
Erroron failure (not theT | ApiErrorunion that reads return). - Pass the initiating app’s
clientIdas the second argument to apply that app’s own fee — it stacks on the global 0.1% (min Rp100, no cap) and credits the app.
Apps, fees & raw calls
PeridotClient also exposes get / post / patch / put / delete for
endpoints without a dedicated wrapper — app management, per-app fees, and machine
auth use these:
Log out
Refreshing
Usually you never callrefresh() directly — the onUnauthorized callback does it. If
you need to force a refresh: