README

Official Node.js/TypeScript and PHP SDKs for Flint.

Install

Install the 8.0.0-beta.2 prerelease explicitly:

npm install @flintpay/node@8.0.0-beta.2
composer require flintpay/flint:8.0.0-beta.2

The beta is also available as @flintpay/node@next. npm's latest tag remains on the stable release. Review the migration guide before upgrading and the changelog for release notes.

Packages

Unreleased changes on main pin Flint main at a29702bf, which adds 83 operations and removes or moves 22 SDK methods; see the unreleased notes. They also add the form-encoded OAuth operations (oauth.exchangeToken, oauth.revokeToken, oauth.authorizeCLIDevice, oauth.reauthorizeCLIDevice and oauth.listCLIContexts) and partner app OAuth helpers in both packages: @flintpay/node/custom/partner-oauth.js and Flint\Partner\*. The helpers build the install consent URL with PKCE and state, check the callback, sign private_key_jwt client assertions, exchange codes, and mint cached 900-second partner app tokens per merchant with client_credentials. See the partner OAuth guide.

PHP: Packagist · Installation and quickstart · API reference
Node.js / TypeScript: npm · Installation and quickstart · API reference

Each package guide includes its own requirements, installation command and examples. Read the migration guide when upgrading.

SDK ↔ API versions

SDK version (Node and PHP)	API version
`8.0.0-beta.2`	`2026-09-07`
`8.0.0-beta.1`	`2026-09-07`
`7.0.0`	`2026-09-07`
`6.0.0`	`2026-09-07`
`5.1.0`	`2026-09-07`
`5.0.0`	`2026-09-07`
`4.0.0`	`2026-09-07`
`3.0.0`	`2026-09-07`
`3.0.0-beta.20261012044000`	`2026-09-07`
`3.0.0-beta.20261009223830`	`2026-09-07`
`3.0.0-beta.20261008013000`	`2026-09-07`
`3.0.0-beta.20261007031000`	`2026-09-07`
`3.0.0-beta.20261006230000`	`2026-09-07`
`3.0.0-beta.20261006210100`	`2026-09-07`
`3.0.0-beta.20261006020957`	`2026-09-07`
`3.0.0-beta.20261003024310`	`2026-09-07`
`2.0.0`	`2026-09-07`
`0.4.0-beta.1`	`2026-09-07`
`0.3.0-beta.1`	`2026-09-07`

The API version identifies the pinned contract used to generate the SDK. The SDK sends this version in the Flint-Version request header. SDK versions and API versions are independent: multiple SDK releases can target the same API version. When upgrading, review both the SDK changes and any API-version change.

Contract and authentication

The pinned API version is 2026-09-07. The packages expose 686 operations from the pinned export, including PDF downloads, redirects, an event stream, and the form-encoded OAuth token, revocation and CLI device operations. Only the browser-only OAuth consent redirect is excluded; build its URL with the partner OAuth helpers. Outbound methods are grouped by resource, such as client.paymentIntents.create(), client.orders.get() and client.refunds.create(). Namespaces follow the first API path segment after /v1; method names follow the operation ID without that namespace noun.

Named credential modes cover merchant API keys and bearer tokens, customer sessions, onboarding, checkout bearer tokens, and invoice tokens. Select the mode appropriate to the operation. Merchant default credentials support environment keys and tokens, GitHub Actions, GitLab CI, Kubernetes, GCP, Azure, AWS and saved CLI sessions. See the default credentials guide for setup and optional AWS dependencies. Anonymous operations remain anonymous. Keep merchant secret keys server-side; customer and checkout credentials have their own scopes.

The refreshed generator supports nullable response fields, including nested resources. Generated response validation follows the pinned API schema, so a response that is missing a required field or has a value of the wrong type throws UnexpectedResponseError.

Generated operation coverage does not establish live backend acceptance. Shared HTTP fixtures exercise both clients without network requests. A published version doesn't mean that a Flint environment serves its pinned contract or that the version passed sandbox transaction testing.

Development and releases

npm run setup       # Build the exact generator revision in sdk.lock.json
npm run profiles    # Derive retry and idempotency settings from spec/openapi.json
npm run diagnose    # Check the pinned contract and profiles
npm run generate    # Regenerate node/, php/, and root composer.json
npm run check       # Fail if committed packages differ from generation
npm run validate    # Validate packages and shared HTTP fixtures
npm test            # Install and test the npm and root Composer archives

Generation requires Node.js 22.14+, npm, Git, PHP 8.2+, Composer 2, and ZIP support. Full generation uses an 8-GiB Node heap; allow at least 10 GiB of process memory. Consumer SDKs do not need this generator heap setting.

Edit sdk.json and spec/profiles/ for SDK configuration, except the retry and idempotency settings in spec/profiles/full-common-sdk.json: npm run profiles derives those from each operation's idempotency class in the export, and the other commands fail while they are stale. spec/openapi.json is an unmodified, checksummed upstream export. sdk.lock.json pins its upstream revision and the generator revision. Do not hand-edit generated files; sdk-files.json records their hashes. The root npm package is private; only node/ is published to npm.

The root composer.json is generated from php/composer.json with relocated autoload paths and no hardcoded version. Packagist reads versions from this repository's v* tags. No PHP distribution mirror is needed.

This repository contains generated SDK distributions. Submit SDK fixes and improvements to flint-pay/sdk-generator, where changes can be regenerated into both packages. See Contributing, release setup and procedures and input provenance.

Visit Flint Pay’s developer docs for API reference, integration guides, authentication and webhooks, including the Node SDK guide.

License

Generated runtime code and the distribution use Apache-2.0. See LICENSE.

flintpay / flint

Package info

Security

Statistics