SDKs

Use an SDK when your code should talk directly to a Thalovant hub.

The Thalovant API is the control plane at https://api.thalovant.com. It discovers hubs and creates client identities. The SDK is the data plane. It sends runtime traffic to the hub over WSS, HTTPS, or MQTT over TLS.

Best First Path

1. Pick the SDK for your runtime. Python, Node.js, Go, and Rust expose the same core behavior.
2. Use the hosted API. Start with https://api.thalovant.com.
3. Create one client identity per app, device, or agent. Store the returned identity in a secret store or protected SDK config file.
4. Connect with WSS first. It is the default realtime path for public clients.
5. Add HTTPS, MQTT, or browser origin access only when needed. Create a fresh identity after enabling a new protocol on the hub, and request an approved SDK Origin before calling the API from a customer-owned browser app.

Choose A Language

Language	Install	Best fit
Python	pip install thalovant	Agents, tools, notebooks, tests, and service workers.
Node.js	npm install @thalovant/sdk	TypeScript services, bots, scripts, and web backends.
Go	go get github.com/thalovant/thalovant-go-sdk	Gateways, CLIs, small services, and long-running workers.
Rust	cargo add thalovant	Strict clients, embedded work, and reliability-focused services.

Python SDKStart with Python.

Node.js SDKStart with Node.js or TypeScript.

Go SDKStart with Go.

Rust SDKStart with Rust.

Supported Versions

The following versions were the current published package set recorded on July 13, 2026. Use the compatibility requirement in a feature’s release note when it needs a newer client.

Consumer	Supported package version	Registry
Python SDK	thalovant 0.4.20	PyPI; clean virtual-environment import verified July 12, 2026
Node.js SDK	@thalovant/sdk 0.2.18	npm; clean ESM import verified July 12, 2026
Go SDK	github.com/thalovant/thalovant-go-sdk v0.3.1	Public Go module; requires Go 1.25 or newer; clean unauthenticated proxy consumer verified July 13, 2026
Rust SDK	thalovant 0.2.17	crates.io; clean consumer check verified July 13, 2026
MCP server	@thalovant/mcp-server 0.1.6	npm, GHCR, and the MCP Registry; aligned package and image smoke verified July 13, 2026

All control-plane calls use the backward-compatible /api/v1 boundary. Additive server fields are safe for older SDKs because clients ignore fields they do not understand. A client that needs a newly added capability must use the minimum version listed in that capability’s release note.

The MCP server uses the Node SDK and is released after its compatible SDK version. MCP 0.1.6 declares @thalovant/sdk ^0.2.15 and was published with aligned npm, OCI, and MCP Registry metadata.

Caution

Package artifacts and Git tags are immutable. If a release is withdrawn, use the replacement version in the release notes instead of pinning an unpublished or rewritten artifact.

How SDK Access Works

1. Discover a hub. Public hub discovery can be used before sign-in.
2. Sign in for private API actions. Creating client identities requires API access on the workspace.
3. Create a client identity. The SDK stores the returned identity locally or in your secret store.
4. Connect to the hub. Runtime traffic goes directly to the hub endpoint.
5. Send a request. Start with one ask call, then add sessions, context, actions, or rich output.

Browser Origins

Browser apps on customer-owned domains need an approved SDK Origin before cross-origin SDK or API calls are accepted.

Approval is exact-origin based and non-credentialed. It allows requests from a reviewed origin, but it does not allow dashboard cookies, refresh-session headers, setup links, or long-lived client identities to be exposed in browser bundles.

Protocols

Protocol	Use it when	Notes
WSS	You want the default public realtime path.	Best first choice for agents and clients that may listen for events.
HTTPS	You want request-response calls, health checks, CLIs, or jobs.	Must be enabled on the hub before public clients can use it.
MQTT over TLS	You want broker-mediated device or edge traffic.	Requires per-client broker credentials and topic access.

Tip

Start with WSS. Add HTTPS or MQTT only when the client has a real reason to use that path.

What To Keep Secret

Every client identity is secret. Store it like a password.

Do not put identity files, access keys, passwords, broker passwords, setup links, or crypto keys in browser bundles, public repos, screenshots, logs, or support tickets.

Production Checklist

Check	Good default
API base URL	https://api.thalovant.com
First runtime protocol	WSS
Browser usage	Use SDK Origins for reviewed browser domains. Keep secrets on a backend.
Identity storage	Use a secret manager, CI secret, mounted secret file, or ~/.config/thalovant/config.yaml with mode 600.
MQTT	Use mqtts://, per-client credentials, and SDK-managed topics.
Rotation	Rotate by creating a new client identity and replacing the old secret.
Logs	Redact identity JSON, broker passwords, API tokens, and crypto keys.

Next

If you already know your language, open the SDK page.

Use SDK Functions when you need method names across languages. Use MQTT when the client connects through the broker. If you are designing a shared SDK feature, use the SDK Contract.

Last reviewed: July 10, 2026. Review this page when an SDK or MCP package version, registry, compatibility requirement, or install command changes.