@fluxyte/sdk 0.3.0 → 0.3.1

package/README.md

@@ -26,6 +26,41 @@ Treat your API key like a password. Do not commit it to source control.
 
 The SDK rejects `sk_*` keys in browser environments to prevent accidental exposure.
 
+## Key Management
+
+### Key Purpose
+
+- `pk_*` (PUBLIC): for browser/frontend SDK usage.
+- `sk_*` (SECRET): for backend/server usage only.
+
+### How to get keys
+
+1. Sign in to Fluxyte dashboard.
+2. Go to `Account` -> `API Keys`.
+3. Create a key and choose type:
+   - `PUBLIC (pk_*)` for frontend SDK traffic.
+   - `SECRET (sk_*)` for backend automation or server integrations.
+4. Copy the key immediately (shown once).
+
+### Allowed origins (PUBLIC keys)
+
+For `pk_*` keys, configure allowed origins in dashboard (for example `https://app.example.com`).
+This limits where browser-based SDK requests are accepted from.
+
+### Rotation and revocation
+
+- Rotate keys on a regular schedule (recommended every 60-90 days).
+- Keep a short overlap window where old and new keys are both valid during rollout.
+- Revoke keys immediately if exposed.
+- Update environment variables and redeploy clients after rotation.
+
+### Environment examples
+
+- Frontend: `NEXT_PUBLIC_FLUXYTE_API_KEY=pk_...`
+- Backend: `FLUXYTE_API_KEY=sk_...`
+
+Never expose `sk_*` in browser bundles, client logs, or public repos.
+
 ## Choose An Entrypoint
 
 The SDK ships multiple entrypoints, all with the same API surface:
@@ -136,6 +171,54 @@ Identity guidance:
 
 ## Onboarding Events
 
+Events power onboarding analytics, drop-off detection, and AI insights.
+
+Supported event types:
+
+1. `FLOW_STARTED`
+- User begins a tracked onboarding flow.
+- Send once when the flow is entered.
+
+2. `STEP_VIEWED`
+- User lands on or opens a specific step.
+- Send whenever the current step changes.
+
+3. `STEP_COMPLETED`
+- User successfully completes a step.
+- Send only after verified completion signal.
+
+4. `FLOW_COMPLETED`
+- User completes all required steps in the flow.
+- Send once at successful finish.
+
+5. `ABANDONED`
+- User exits/stalls before completion.
+- Send when inactivity timeout or explicit exit indicates drop-off.
+
+Recommended minimum context for event quality:
+
+- `product` or `service`
+- `userTarget`
+- `flowSlug`
+- `stepSlug` (for step-level events)
+- stable identity (`context.sessionId` or `context.userId`)
+
+Typical event sequence:
+
+1. `FLOW_STARTED`
+2. `STEP_VIEWED` (step 1)
+3. `STEP_COMPLETED` (step 1)
+4. `STEP_VIEWED` (step 2)
+5. `STEP_COMPLETED` (step 2)
+6. `FLOW_COMPLETED`
+
+Drop-off sequence example:
+
+1. `FLOW_STARTED`
+2. `STEP_VIEWED` (step 1)
+3. `STEP_VIEWED` (step 2)
+4. `ABANDONED`
+
 ```ts
 await client.sendEvent({
   type: "STEP_COMPLETED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fluxyte/sdk",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Official Fluxyte SDK (TypeScript) for the Fluxyte Onboarding AI API",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
@@ -56,4 +56,3 @@
     "typescript": "^5.4.0"
   }
 }
-