Version 0.11.0 defaults catalog requests to https://api.nozle.app/engine.
Peer dependencies are @tanstack/react-query 5 or later (required from 0.11.0), react and react-dom 18 or later, @stripe/react-stripe-js 3 or later, and @stripe/stripe-js 5 or later. Install the Stripe packages even if you only use PricingTable or BillingPortal: without them the import fails with ERR_MODULE_NOT_FOUND.
The React SDK has two browser-safe responsibilities:
- read the public plan catalog with a publishable
pk_ key; and
- render checkout and billing UI using data or callbacks supplied by your application.
It does not accept a secret key or choose a Nozle customer. The native billing portal uses customer-scoped GraphQL reads using a session issued by your backend; it never uses your secret key in the browser.
BillingPortal, CancellationControl, PlanChangeControl, and their self-service adapters are included from 0.10.2. Use Node 0.10.0, Python 0.10.0, or Go v0.9.1 or later on your merchant backend. The billing hooks need React 0.11.0 with a backend on Node 0.13.0. See Billing portal and self-service for setup.
Wrap public catalog and provider-context checkout UI in BillingProvider. BillingPortal and its management controls use their own callbacks and do not require this provider. Your createCheckout callback calls an authenticated merchant endpoint; that endpoint derives the customer from the logged-in user or team and calls Nozle with a restricted sk_.
Provider props
BillingProvider throws when publishableKey does not begin with pk_.
subscriptionId and quoteId are passed only by UpgradeButton and UpgradeModal.
Implement the merchant endpoint
The merchant endpoint must:
- authenticate the application user;
- derive the Nozle customer from server-owned user or team data;
- reject browser-provided customer identifiers;
- validate the requested plan and exact HTTPS return origin; and
- call Nozle with a least-privilege
sk_.
See Merchant backend billing for a complete route.
Framework notes
The published bundle has no "use client" directive. In a Next.js App Router server component, import the SDK in your own client component (a file starting with "use client") and render that instead. Both the ESM and CJS builds load in Node, and renderToString works for PricingTable and BillingPortal.
Customer state for presentational components comes from your authenticated backend. Pass it into FeatureGate, UsageMeter, and PlanBadge, from your own route or from the billing hooks when you set billingEndpoint. CurrentPlan reads the billing hooks itself. The native portal instead obtains a customer-scoped session from that backend for its Core GraphQL requests; management actions still go through your authenticated merchant endpoints.
Never embed an sk_, master key, portal session token, or internal credential in a static browser bundle. Return scoped portal tokens only at runtime to the authenticated customer. CORS and Origin headers are not authentication.
Next steps