MossClient authenticates using your projectId and projectKey:
projectKey in client-side code. Instead, implement a custom IAuthenticator that fetches a short-lived token from your own backend.
The IAuthenticator interface
The SDK exports IAuthenticator and AuthToken types from @moss-dev/moss. Their
shapes are shown below for reference - you don’t need to redefine them in your code.
getAuthHeader() before every request.
Recommended setup
1. Your backend - expose a token endpoint
Your backend holds theprojectKey securely and uses the SDK to fetch a token, returning it directly to the frontend.
2. Your frontend - implement IAuthenticator
Since your backend forwards the Moss auth response unchanged, response.json() already matches the AuthToken shape - no manual mapping needed.
Token caching
The SDK automatically wraps your authenticator with an internal caching layer. Tokens are cached forexpiresIn - 60 seconds, so your backend is only called when the token is about to expire - not on every SDK request. No extra setup is needed.
Summary
Rule of thumb: your
projectKey must never appear in browser-facing code. The custom authenticator pattern ensures it stays on your server while the frontend still gets authenticated access to Moss.