hivewrite-sdk 1.1.45 → 1.1.47

package/README.md

@@ -50,7 +50,11 @@ const MyEditor = () => {
   useEffect(() => {
     if (containerRef.current) {
       hivewrite.init({
-        apiKey: "your-api-key",
+        authorize: async () => {
+          // Best practice: Fetch from your backend to keep API key secure
+          const response = await fetch("/api/hivewrite/authorize");
+          return await response.json(); // Must return AuthData structure
+        },
         container: containerRef.current,
         mode: "FULL_EDITOR",
         theme: "dark",
@@ -75,7 +79,10 @@ const MyEditor = () => {
 <script src="https://cdn.jsdelivr.net/npm/hivewrite-sdk@latest/bundle.min.js"></script>
 <script>
   hivewrite.init({
-    apiKey: "your-api-key",
+    authorize: async () => {
+      const response = await fetch("/api/hivewrite/authorize");
+      return await response.json();
+    },
     container: "#editor-container",
     mode: "FULL_EDITOR",
     theme: "dark",
@@ -100,14 +107,13 @@ Initializes and mounts the editor.
 
 | Parameter      | Type                    | Required | Description                                                                                                                                         |
 | :------------- | :---------------------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `apiKey`       | `string`                | Yes      | Your HiveWrite API Key                                                                                                                              |
+| `authorize`    | `() => Promise<AuthData>` | Yes      | Callback function that returns authorization data (token and account info)                                                                         |
 | `container`    | `string \| HTMLElement` | Yes      | CSS selector or DOM element to mount the editor                                                                                                     |
 | `userId`       | `string`                | No       | Unique identifier for the current user                                                                                                              |
 | `mode`         | `string`                | Yes      | `'FULL_EDITOR'`, `'DESIGN_ONLY'`, `'READ_ONLY'`                                                                                                     |
 | `theme`        | `string`                | No       | `'light'` (default) or `'dark'`                                                                                                                     |
 | `locale`       | `string`                | No       | `'en'` (default), `'es'`, or `'fr'`                                                                                                                 |
 | `branding`     | `object`                | No       | Custom white-labeling options (`primaryColor`, `secondaryColor`, `accentColor`, `logoUrl`, `customCSS`)                                             |
-| `permissions`  | `object`                | No       | Toggle features: `showExport`, `showAiMagic`, `showUploadImages`, `showSaveButton`, `showTemplateLibrary`, `showStarterTemplates`, `showHtmlImport` |
 | `mergeTags`    | `array`                 | No       | Array of `{ label, value }` for dynamic content                                                                                                     |
 | `portalTarget` | `string`                | No       | `'window'` (default) or `'container'`. Controls where dialogs render.                                                                               |
 | `callbacks`    | `object`                | No       | Event hooks for SDK actions                                                                                                                         |
@@ -136,6 +142,68 @@ Initializes and mounts the editor.
 
 ---
 
+## 🔐 Authentication & Security
+
+HiveWrite uses a callback-based authentication system to ensure your API keys are never exposed in the client-side code.
+
+### 1. The `authorize` Callback
+
+You must provide an `authorize` function that returns a `Promise` resolving to `AuthData`.
+
+```javascript
+import { EmailEditor } from "hivewrite-sdk";
+
+EmailEditor.init({
+  authorize: async () => {
+    // Call your backend proxy
+    const res = await fetch("/api/hivewrite-auth");
+    return await res.json();
+  },
+  // ... other config
+});
+```
+
+### 2. Backend Implementation (Recommended)
+
+To keep your `pk_live_...` API key secure, implement a proxy endpoint on your server:
+
+```javascript
+// Example Node.js/Express backend
+app.get("/api/hivewrite-auth", async (req, res) => {
+  const response = await fetch("http://172.184.146.100/api/v1/authorize/", {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${process.env.HIVEWRITE_API_KEY}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      origin: "http://your-app-domain.com" // Pass your app's origin for allowlisting
+    })
+  });
+  
+  const authData = await response.json();
+  res.json(authData);
+});
+```
+
+### 3. AuthData Structure
+
+The `authorize` callback must return an object with the following structure:
+
+```typescript
+{
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  account: {
+    id: string;
+    plan: string;
+  }
+}
+```
+
+---
+
 ## 📤 Export Options
 
 ### Export to HTML
@@ -193,23 +261,6 @@ branding: {
 
 ---
 
-## 🔐 Permissions
-
-Control what features are available:
-
-```javascript
-permissions: {
-  showExport: true,           // Allow HTML export
-  showUploadImages: true,     // Enable image uploads
-  showAiMagic: true,          // Enable AI features
-  showSaveButton: true,       // Show the built-in save button
-  showTemplateLibrary: true,  // Show template library
-  showStarterTemplates: true  // Show starter templates
-}
-```
-
----
-
 ## 🏷️ Merge Tags
 
 Add dynamic content placeholders: