# Install an SDK

The SDKs are optional, ergonomic wrappers around the
**[HTTP API](/docs/api-reference)**. They add named reporting helpers, a
background queue, retries with backoff, and graceful shutdown flushing — so you
never block your app or lose a report.

If you'd rather not add a dependency, you can call the API directly from any
language; see the **[Quickstart](/docs/get-started/quickstart)**.

## JavaScript / TypeScript

```bash
npm i bugboard
```

Runs on Node 20+, browsers, and edge runtimes with **nothing to install or wire
up** — it uses the platform `fetch`. The default reporting path loads no
dependencies; opt-in payload encryption is the one feature that needs a crypto
library, and the SDK lazy-loads a tiny tweetnacl sealed-box binding
(`tweetnacl-sealedbox-js`) automatically the moment you set an encryption key —
never otherwise.

It's **one package with one import**. `import { createClient } from 'bugboard'`
is the whole surface, on every runtime — there is nothing framework-specific to
install or wire up.

Read the **[JavaScript / TypeScript guide](/docs/sdks/javascript)**, or browse the source on
**[GitHub](https://github.com/bug-board/bugboard-js)**.

## PHP

```bash
composer require bugboard/sdk
composer require guzzlehttp/guzzle
```

Requires PHP 8.2+ and any PSR-18 HTTP client (Guzzle is recommended).

> **Using payload encryption?** It needs PHP's `sodium` extension enabled on the
> host. It ships with PHP but is often packaged separately, so a fresh server may
> not have it — check with `php -m | grep sodium`, and if it's missing, follow
> **[Enabling PHP's sodium extension](/docs/security/encryption#enabling-phps-sodium-extension)**.
> Plain reporting needs no crypto and works without it.

Read the **[PHP guide](/docs/sdks/php)**, or browse the source on
**[GitHub](https://github.com/bug-board/bugboard-php)**.

## Configure the client

Every SDK reads the same configuration. Servers use a **secret** key; browser
and mobile clients embed a **publishable** key.

| Context                        | Environment variables                        |
| ------------------------------ | -------------------------------------------- |
| Server (Node/PHP)              | `BUGBOARD_KEY_ID`, `BUGBOARD_SIGNING_SECRET` |
| Vite (React/Vue/Svelte client) | `VITE_BUGBOARD_API_KEY`                      |
| Next.js (client)               | `NEXT_PUBLIC_BUGBOARD_API_KEY`               |

> The client variables hold a `bb_pub_…` publishable token (safe to expose). The
> server `BUGBOARD_SIGNING_SECRET` holds a `bb_sec_…` secret — never expose it.

The full config reference lives in the
**[API Reference](/docs/api-reference)**.

## Wire it into your framework

Where you build the client, and what makes sure queued reports are actually
delivered, differs per framework. The **[framework guides](/docs/frameworks)**
cover each one end to end:

- **PHP** — **[Laravel](/docs/frameworks/laravel)** ·
  **[Symfony](/docs/frameworks/symfony)** · **[Plain PHP](/docs/frameworks/plain-php)**
- **JavaScript** — **[Express, Fastify, Koa](/docs/frameworks/node)** ·
  **[NestJS](/docs/frameworks/nestjs)** · **[Next.js](/docs/frameworks/nextjs)** ·
  **[Nuxt](/docs/frameworks/nuxt)** · **[SvelteKit](/docs/frameworks/sveltekit)** ·
  **[Remix](/docs/frameworks/remix)** · **[Vite SPA](/docs/frameworks/vite-spa)** ·
  **[Serverless & edge](/docs/frameworks/serverless)**