Integration

JavaScript SDK

A TypeScript/JavaScript client for a hosted control-plane — works identically in Node (18+, global fetch) and the browser. Mirrors the Python SDK, method names translated to camelCase.

Install

terminal

npm install boxkite-client

Construct a client

quickstart.ts

import { BoxkiteClient } from "boxkite-client";

const client = new BoxkiteClient({
  baseUrl: "https://your-control-plane.example.com",
  apiKey: "bxk_live_...",
});

const result = await client.withSandbox(async (sb) => {
  const exec = await sb.exec("python3 -c 'print(1 + 1)'");
  return exec;
});
// sandbox is destroyed automatically here, even if the callback threw

withSandbox is the JS equivalent of Python's client.sandbox() context manager. Without it, you own create/destroy yourself via client.createSandbox(...)/client.destroySandbox(...) — see the Sandboxes page for every parameter both accept (size/storage/lifetime/count).

Every capability, from this client

Sandboxes — createSandbox/getSandbox/listSandboxes/destroySandbox
Process & exec — sb.exec(...), startProcess/getProcessOutput/sendProcessInput/stopProcess/listProcesses
File system — fileCreate/view/strReplace/ls/glob/grep
Command allowlist — getAllowedCommands/setAllowedCommands/clearAllowedCommands
Custom sandbox images — createImage/getImage/listImages/deleteImage, opt-in declarative builder
Independent storage volumes — createVolume/getVolume/listVolumes/deleteVolume, opt-in PVC-backed storage
Secrets management — createSandbox({ secretNames: [...] }), httpRequest()
Webhooks — createWebhook/listWebhooks/deleteWebhook/listWebhookDeliveries
Network ingress & previews — createPreviewUrl/revokePreviewUrl
Audit log & takeover — getLog/watch/takeover

LangChain.js agent

agent.ts

import { BoxkiteClient } from "boxkite-client";
import { createSandboxTools } from "boxkite-client/langchain";

const client = new BoxkiteClient({ baseUrl: "...", apiKey: "..." });
const sandbox = await client.createSandbox({ label: "agent-session" });

const tools = createSandboxTools(client, sandbox.id);
// tools = [bash_tool, file_create, view, str_replace, ls, glob, grep,
//   start_process, get_process_output, send_process_input, stop_process,
//   list_processes] -- same names as the Python SDK, plus http_request if
// { enableHttpRequestTool: true } is passed. Requires @langchain/core as a
// peer dependency.

Never put a real apiKey in code that ships to a browser

An API key is a full-privilege, long-lived account credential — it can create/destroy sandboxes, consume your usage quota, and read/write sandbox files. This SDK never writes it to localStorage/cookies, but that doesn't help once the key itself reaches the browser: anything shipped to a browser is visible in devtools/view-source to every visitor.

If your app needs to call boxkite from browser JS, mint a short-lived, scoped credential from your own backend instead of embedding the account's bxk_live_...key directly. Treat "browser" as "code whose source a user can see" — that includes a React Native app or an Electron renderer without context isolation, too.