Skip to main content
The Clink Node.js SDK provides convenient access to the Clink API from applications written in server-side JavaScript or TypeScript. It includes TypeScript definitions for all request parameters and response fields.

NPM Package

View the package on npmjs.com

Installation

Install the package with your preferred package manager:

Quick Start

To start using the SDK, you need to initialize the client with your API Key. You can find your secret keys in the Developers section of your Clink dashboard.
Security Note: The SDK is intended for server-side use only. Never expose your Secret API keys in client-side code (browsers) or public repositories.
For Elements, create the session with uiMode: 'elements' and provide returnUrl, for example https://YOUR_DOMAIN/complete.html?session_id={ELEMENTS_SESSION_ID}. Clink replaces {ELEMENTS_SESSION_ID} with the created session ID. For the embedded iframe from @clink-ai/clink-js, use uiMode: 'hostedPage' instead — that SDK mounts the hosted checkout page as-is.

API Overview

  • createCheckoutSession(options): Create a checkout session and get the redirect url.
  • getCheckoutSession(sessionId): Retrieve checkout session details.
  • getOrder(orderId): Retrieve order details.
  • getRefund(refundId): Retrieve refund details.
  • getSubscription(subscriptionId): Retrieve subscription details.
  • getInvoice(invoiceId): Retrieve subscription invoice details.
  • customerPortalSession(options): Create a customer portal session and get the access link.
All methods are asynchronous and throw on errors.

Error Handling

When the API returns a non-success status code (4xx or 5xx), the SDK throws an error. You should wrap your API calls in try/catch blocks.

Verifying webhooks

ClinkWebhook computes and compares the HMAC for you, so you do not have to write it yourself.
verifyAndGet() in 1.0.1 verifies the HMAC and nothing else. It does not check X-Clink-SignType, does not check timestamp freshness, and compares signatures with === rather than a constant-time comparison.The first two are screened above. For the third, compute the HMAC yourself with crypto.timingSafeEqual — see Hosted Checkout.Verifying the signature is also not the same as being safe to act on. Deduplicate on event.id with a unique index before doing any work.
verifySignature() returns a boolean instead of throwing, and signature() generates one — useful for building signed test events locally.

References