Skip to main content
@endstate-sdk/reader turns a physical tap into an identified chip in your browser application: every tap yields the same chip_id and e value the chip endpoints speak, so the output feeds the API without any parsing on your side. The package is TypeScript-first, has zero runtime dependencies, and is licensed Apache-2.0.

Install

Read a tap

pickReader() selects the best reader available in the current browser. Call connect() and start() from a click handler: the first visit may open a browser device or permission prompt. After that the browser remembers the reader and later connects are silent - see Readers and environments.
Each tap delivers:
string
The full URL read from the tag.
^[0-9A-F]{10}$
The chip’s public identifier - the API’s chip_id.
^[0-9A-F]{32}$
The single-use tap credential - treat it like a password and use it promptly.
^[0-9A-F]{16}$
Tap verification code, included when the tag provides one - forward it to your backend alongside e.
chipId and e are present whenever the tag carries an Endstate chip URL, and absent otherwise - check for them before calling your backend.

Keep API keys out of the browser

Reader hardware runs in the browser; secret keys (end_sk_…) never do. Pairing is always two-legged: the reader identifies the chip client-side, and your backend - the only place your API key lives - makes the pairing call.
Your backend then pairs the chip with POST /v1/chips (chip_id + e), or records a tap with POST /v1/taps (chip_id + e in the body). The Core SDK takes this reader’s output unchanged:
Core is optional - this package emits the raw values the REST API speaks, so any HTTP client works. See the API reference. POST /v1/taps is the one call a page can make on its own: send a publishable key (end_pk_live_…) instead of the API key and the browser talks to Endstate directly - useful when the tap happens on a customer’s phone rather than an operator’s station.

Next