Getting started

APICenter gives teams in an organization a governed way to use shared APIs such as email, SMS, OTP, geocoding, Google sign-in, and payments. A service calls APICenter from its backend with the @alpha-explora/apicenter-sdk package.

1. Get access and register your service

Ask an organization administrator to confirm your Management access and help place the service in the registry. The registry hierarchy is:

Organization → Tribe → Project → Service

Organizations define Management access. The Registry page displays tribes, projects, and services. If you need an organization or membership, ask an APICenter administrator; the console does not create organizations or manage memberships.

Follow Access and tenancy and Register a service. Registration defines the service ID, project placement, runtime URL, environment, exposed routes, required scopes, and shared-service dependencies.

2. Install the SDK

The package is hosted in restricted GitHub Packages. Your GitHub account or automation identity needs permission to read the APICenter packages.

Add this to the consumer repository's .npmrc:

@alpha-explora:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

Set NODE_AUTH_TOKEN from a secret store to a GitHub token with package read access. Do not commit the token. Install the released SDK:

npm install @alpha-explora/apicenter-sdk@2.0.0

See SDK integration for payments, other namespaces, and error handling.

3. Configure server-only credentials

Ask an operator to issue a service secret for each environment you use. Keep these values in your backend's environment or secret manager. Never put them in browser code, a mobile app, a checked-in .env file, or a NEXT_PUBLIC_ variable.

APICENTER_URL=https://api.apicenter.itsandbox.site
APICENTER_SERVICE_ID=orders-api
APICENTER_ENVIRONMENT=test
APICENTER_SERVICE_SECRET=<secret-issued-for-this-service-and-environment>

Use separate credentials for test and live. The SDK exchanges the service ID, environment, and secret for a short-lived APICenter token and refreshes it when needed.

4. Make a shared-service request

This example sends email from a Node.js backend. Create and persist an idempotency key for the business operation, then reuse that same key if you retry it.

import { ApiCenter } from '@alpha-explora/apicenter-sdk';

const api = new ApiCenter({
  baseUrl: process.env.APICENTER_URL!,
  auth: {
    serviceId: process.env.APICENTER_SERVICE_ID!,
    environment: process.env.APICENTER_ENVIRONMENT as 'test' | 'live',
    secret: process.env.APICENTER_SERVICE_SECRET!,
  },
});

await api.email.send(
  {
    to: 'person@example.com',
    subject: 'Your order is ready',
    text: 'Your order is ready for pickup.',
  },
  { idempotencyKey: order.emailRequestKey },
);

APICenter checks the service's registered placement and scopes. If a call is denied, check that the service has the required scope and that the requested shared service is listed as a dependency in its registry entry.

Next steps

• Authentication and scopes
• SDK integration
• Management access and tenancy
• Register a service
• Consumer runbook