@craveup/storefront-sdk. Public catalog reads are anonymous. Cart mutations use the short-lived capability returned when the cart is created; no API key or BFF is required.
Prerequisites
- Node.js 20+ and a package manager
- A published Crave merchant and location
- The public Crave API origin for your environment
- The exact deployed browser origin registered with Crave
1. Create the app and install the SDK
2. Configure public identifiers
VITE_ variable.
3. Create a tab-scoped session store
X-Cart-Token, If-Match, and Idempotency-Key where required and updates the stored cart revision from response ETags. The canonical API environment, merchant, and resource scopes prevent credentials from crossing storefronts. Save the verified customer JWT with customerTokenStore.set(token); save a fragment-delivered receipt capability only with receiptTokenStore.set(receiptId, token) and remove it after terminal display.
4. Fetch the published merchant
5. Start a cart and add an item
CART_CONFLICT, refresh the cart and ask the user to retry; do not replay the mutation automatically. Clear the cart capability after claim, deletion, expiry, or terminal checkout handling, and clear the merchant-scoped JWT on logout.
marketplaceId is an optional source-attribution label, such as "web"; it is
not a location ID. The route already scopes the cart to locationId.
6. Register the browser origin
Register the exact deployed origin—including scheme, hostname, and any non-default port—with Crave before testing. Register stable preview origins separately; wildcard origins are not accepted.Next steps
Display Menu
Fetch the published menu and product data.
Manage Cart
Handle capabilities, revisions, and idempotent mutations.
Checkout Flow
Create a payment intent and poll the authoritative order result.
SDK Reference
See the complete direct API client.
Slack Community
Ask questions and get help from the Crave team and community.
Email Support
Reach out to hello@craveup.com for direct support.