Authorize from any trusted Node backend.

Call GateKit from your backend

Put the GateKit project API key in a server environment variable. Your browser or mobile client may send a wallet address to your own backend, but the GateKit credential stays on the trusted side of that boundary.

Use the REST API immediately

const response = await fetch("https://gatekit-ruddy.vercel.app/api/v1/verify", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.GATEKIT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    policyId: process.env.GATEKIT_POLICY_ID,
    wallet,
  }),
});

const result = await response.json();

if (response.status === 503 && result.status === "error") {
  // Verification unavailable. Fail closed.
}

if (!response.ok) {
  // Auth, validation, policy lookup or quota error.
}

if (result.status === "denied") {
  // Conclusive policy denial.
}

if (result.status === "allowed") {
  // Grant result.entitlements.
}

This path is package-name independent and is the safest integration while the public SDK namespace release gate is still open.

Private Beta SDK

# Private Beta package name is provisional until the public namespace gate closes.
# Use the REST example today, or the private SDK build supplied to beta testers.

import { createGateKitClient } from "<private-beta-sdk-package>";

const gatekit = createGateKitClient({
  apiKey: process.env.GATEKIT_API_KEY!,
});

const result = await gatekit.verify({
  policyId: process.env.GATEKIT_POLICY_ID!,
  wallet,
});

The SDK implementation is build-ready, but its final public package/import name will only be published after GateKit owns and locks the release namespace.

Three decision states

allowed and denied are conclusive policy results. error means verification could not produce a trustworthy decision, returns HTTP 503, and should be handled as a temporary fail-closed condition.