Creating a client

import { NoughtyToursController } from "@thenoughtyfox/noughty-tours-web-sdk";

const NTController = new NoughtyToursController({
  getBearerToken: async () => {
    // Call your own backend. It signs a short-lived token with your
    // private key and returns it. We never see the key.
    const res = await fetch("https://yourbackend.com/api/auth-token", { method: "POST" });
    const { access_token } = await res.json();
    return access_token;
  }
});

const tours = await NTController.tours.list();

Create the client once, outside your component tree, and share the instance.

Constructor options

Option	Type	Description
getBearerToken (required)	() => Promise<string>	Resolves to the token for the next request. Called before every call, so it is the natural place to refresh an expired token.

getBearerToken is the only option. Passing anything other than a function throws a TypeError at construction time.

API origin

The client targets the Noughty Tours API at https://api.dev.sdk.thenoughtyfox.com. The origin is built in and not configurable.

Sign this origin as your aud

The aud claim your backend signs has to be the origin above. It is set in your backend code, far from the frontend that consumes it, so it is easy to get wrong — and every token is rejected when it is.

Resources

Resource	Purpose
NTController.tours	Tours, including their floors, rooms and scans
NTController.floors	Floor metadata and floor-plan documents
NTController.rooms	Room metadata
NTController.scans	Panorama pose, orientation and thumbnails

Methods return promises that resolve to the parsed response body, or reject with an ApiError. Responses carrying no content resolve to null.

Token lifecycle

getBearerToken() is awaited immediately before every request. An uncached implementation therefore costs a round trip to your backend per SDK call — cache the token in your own code and return a fresh one only when the old one nears expiry. See Authentication.

Requests abort after 15 seconds.