@devvit/external-endpoints 0.12.23-next-2026-05-07-21-21-02-37fac60f0.0

package/LICENSE

@@ -0,0 +1,26 @@
+Copyright (c) 2023 Reddit Inc.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.

package/README.md

@@ -0,0 +1,28 @@
+# @devvit/external-endpoints
+
+The external endpoints feature supports invoking a Devvit app's `/external/…` endpoints from outside HTTP requests.
+
+## Short-term Callbacks
+
+Callbacks are external requests that are initiated by a Devvit app over a short time period. Callback URLs can only be used once and expire quickly. Callbacks are invoked in the same `context` they were initiated in and may invoke plugins as the user account via run-as.
+
+### Example
+
+1. A user clicks a button in your app's web view.
+2. The button calls `fetch('/api/word-of-the-day/new', {method: 'POST'})`.
+3. Your Devvit app server receives the fetch and invokes `external.getCallbackUrl('onWordNew')` to generate a callback URL. Eg, `https://wotdapp-2th52-external.devvit.net/external/on/word/new?externalToken=devvit_at_abc123`.
+4. Your Devvit app server passes the callback URL in a request to an external server, `fetch('https://example.com/word-of-the-day/new', {method: 'POST', body})`.
+5. Your Devvit app server doesn't wait for the callback. It responds to the `/api/word-of-the-day/new` request to let the user know their request has been received.
+6. Your external server, `example.com`, has a short time period to unpack the callback URL from the request, do whatever work it needs to, and call the Devvit app back using the given callback URL like `fetch('https://wotdapp-2th52-external.devvit.net/external/on/word/new?externalToken=devvit_at_abc123', {method: 'POST'})`. Only `getCallbackUrl()` generated URLs are supported for external requests; the token must appear in the URL as a query param.
+7. Your Devvit app server gets the callback request from `example.com` on its `/external/on/word/new` endpoint. Perhaps your app submits a post containing the word of the day.
+
+## Long-term App Tokens Calls
+
+App token calls are usually initiated by external servers. Unlike callbacks, they have long token lifetimes which may be reused and are managed by the app developer. Long-term invocations always execute with subreddit installation `context` as the app account.
+
+### Example
+
+1. Your external server calls `https://weatherapp-cs7yk0-external.devvit.net/external/weather/alert` with an `Authorization` header containing the app token. Eg, `bearer devvit_at_abc123`.
+2. Your Devvit app server's receives the `/external/weather/alert` request.
+
+Sign up for Reddit's Developer Platform [here!](https://developers.reddit.com)

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@devvit/external-endpoints",
+  "version": "0.12.23-next-2026-05-07-21-21-02-37fac60f0.0",
+  "license": "BSD-3-Clause",
+  "repository": {
+    "type": "git",
+    "url": "https://developers.reddit.com/"
+  },
+  "type": "module",
+  "exports": {
+    "./server": {
+      "browser": "./server/serverImportInClientCodePanic.js",
+      "default": "./server/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "**"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf .turbo coverage dist",
+    "clobber": "yarn clean && rm -rf node_modules",
+    "lint": "redlint .",
+    "lint:fix": "yarn lint --fix",
+    "prepublishOnly": "publish-package-json",
+    "test": "yarn test:unit && yarn test:types && yarn lint",
+    "test:types": "tsc --noEmit",
+    "test:unit": "vitest run",
+    "test:unit-with-coverage": "vitest run --coverage"
+  },
+  "dependencies": {
+    "@devvit/protos": "0.12.23-next-2026-05-07-21-21-02-37fac60f0.0"
+  },
+  "peerDependencies": {
+    "@devvit/server": "*"
+  },
+  "devDependencies": {
+    "@devvit/repo-tools": "0.12.23-next-2026-05-07-21-21-02-37fac60f0.0",
+    "@devvit/server": "0.12.23-next-2026-05-07-21-21-02-37fac60f0.0",
+    "@devvit/tsconfig": "0.12.23-next-2026-05-07-21-21-02-37fac60f0.0",
+    "eslint": "9.11.1",
+    "typescript": "5.8.3",
+    "vitest": "4.0.15"
+  },
+  "gitHead": "758161fe5f8b765a03d15a7c9f8eb4bf13330f0d"
+}

package/server/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":""}

package/server/index.js

@@ -0,0 +1 @@
+export {};

package/server/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../../src/server/index.test.ts"],"names":[],"mappings":""}

package/server/serverImportInClientCodePanic.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Hey! If you're seeing this, you're probably trying to run server code in the
+ * client context, or you have your server build environment set up incorrectly.
+ * To fix this:
+ * 1) Check that you're not importing server code in your client files. If you
+ *    are, you should import from `@devvit/web/client` instead of
+ *    `@devvit/web/server`. `@devvit/external` is server only and has no client
+ *    support.
+ * 2) If this is coming from server code, ensure that your client's tsconfig &
+ *    build environment is set up correctly - specifically, make sure you do NOT
+ *    have `compilerOptions.customConditions` set to include `["browser"]` in
+ *    your `tsconfig.json` file. Also, verify that whatever bundler you're using
+ *    (esbuild, vite, etc.) is bundling the client code for a Node environment,
+ *    and not a web browser!
+ */
+export {};
+//# sourceMappingURL=serverImportInClientCodePanic.d.ts.map

package/server/serverImportInClientCodePanic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverImportInClientCodePanic.d.ts","sourceRoot":"","sources":["../../src/server/serverImportInClientCodePanic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/server/serverImportInClientCodePanic.js

@@ -0,0 +1,17 @@
+/**
+ * Hey! If you're seeing this, you're probably trying to run server code in the
+ * client context, or you have your server build environment set up incorrectly.
+ * To fix this:
+ * 1) Check that you're not importing server code in your client files. If you
+ *    are, you should import from `@devvit/web/client` instead of
+ *    `@devvit/web/server`. `@devvit/external` is server only and has no client
+ *    support.
+ * 2) If this is coming from server code, ensure that your client's tsconfig &
+ *    build environment is set up correctly - specifically, make sure you do NOT
+ *    have `compilerOptions.customConditions` set to include `["browser"]` in
+ *    your `tsconfig.json` file. Also, verify that whatever bundler you're using
+ *    (esbuild, vite, etc.) is bundling the client code for a Node environment,
+ *    and not a web browser!
+ */
+console.error("Can't import server code in the client!");
+export {};