Skip to main content

Loading the SDK

The SDK is a single script served from sdk.usehasp.com. It defines a global HaspSDK class. Every release is published under two kinds of URL — pick one based on how much change you want to absorb automatically.

Pinned + integrity (production)

Pin an exact version and add its integrity hash. The browser refuses to run the script if a single byte differs from what you pinned, so a compromised or misconfigured CDN cannot change the code running next to your users’ data — and nothing changes in your app until you change the tag.
crossorigin="anonymous" is required: browsers only check integrity on cross-origin scripts fetched with CORS. Get the current version and its integrity value from the release manifest (the values in these examples are illustrative — always copy them from the manifest):
Use files.versioned as the file name and integrity as the attribute value. files.hashed names the same bytes by content hash, if you prefer content-addressed URLs. A published version is never modified: a fix ships as a new version, so upgrading is a deliberate change to the version and integrity in your tag. You can confirm which build a page loaded with HaspSDK.version.

Floating (prototypes)

v1.js always serves the latest 1.x release. Releases on the v1 channel never remove or rename anything, so your code keeps working; you receive fixes and additions within about 5 minutes without editing your app. Don’t add integrity to this URL — the next release would stop your app from loading.
Always use the full CDN URL. Never use a relative path like /sdk/v1.js.

ES modules

The SDK is a classic script, not an ES module — import HaspSDK from '…/v1.js' does not work. Load it with a <script> tag before your module code, then use the global:
The SDK wraps the Data API; every SDK method maps to a Data API endpoint.

Constructor Options

How appId is Resolved

The SDK reads appId from window.__HASP__.appId, which is injected by HASP when your app is served. You never set this yourself. If appId cannot be resolved, the constructor throws immediately with ErrorCode.MissingAppId.

Retry Behavior

The SDK retries automatically for:
  • 429 Rate Limited — respects Retry-After header if present (integer seconds or HTTP-date)
  • 502 Bad Gateway — network infrastructure hiccups
  • Network failures (device offline, DNS failure) — for GET and single-record DELETE only (idempotent)
POST, PATCH, and bulk DELETE are not retried on network failure to avoid double-writes. Single-record DELETE is retried because it is idempotent. 503 Maintenance is never retried — the SDK enters maintenance mode immediately.

Cleanup

Call destroy() when your app unmounts to abort all in-flight requests and clear event handlers:
Pending promises reject with an AbortError. After destroy(), maintenance event handlers are also cleared.