Node.js chat API: put your server in the conversation

Tokens and REST calls from Node

// lib.mjs. Ran on Node 22.23.4, Oct 2026, with Node's built-in crypto.
// Claims from the TalkJS authentication and REST API docs.
import { createHmac } from 'node:crypto';

export const APP_ID = process.env.TALKJS_APP_ID;
const SECRET = process.env.TALKJS_SECRET_KEY; // server only

const b64url = (obj) => Buffer.from(JSON.stringify(obj)).toString('base64url');

// HS256 JWT with node:crypto only
export function signHS256(payload, secret = SECRET) {
  const data = `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url(payload)}`;
  const sig = createHmac('sha256', secret).update(data).digest('base64url');
  return `${data}.${sig}`;
}

const now = () => Math.floor(Date.now() / 1000);
export const userToken = (userId, ttl = 3600) =>
  signHS256({ tokenType: 'user', iss: APP_ID, sub: userId, exp: now() + ttl });
export const adminToken = (ttl = 30) =>
  signHS256({ tokenType: 'admin', iss: APP_ID, exp: now() + ttl });

You don’t need a JWT package. The authentication docs sign the same claims with jsonwebtoken, and TalkJS accepted tokens from both in our test. Keep the secret key on your server and out of frontend code. In the browser, the chat gets its user token through session.onNeedToken, which fetches it from an endpoint of yours. We ran that against a plain node:http route.

// Ran on Node 22.23.4, Oct 2026, with built-in fetch.
// Endpoints from the TalkJS REST API docs; we renamed the test users.
// APP_ID and adminToken() come from lib.mjs above.
async function talkjs(method, path, body) {
  const res = await fetch(`https://api.talkjs.com/v1/${APP_ID}${path}`, {
    method,
    headers: { Authorization: `Bearer ${adminToken()}`, 'Content-Type': 'application/json' },
    body: body && JSON.stringify(body),
  });
  if (!res.ok) throw new Error(`${method} ${path} -> ${res.status} ${await res.text()}`);
  return res.json();
}

await talkjs('PUT', '/users/shop', { name: 'Shop updates' });
await talkjs('PUT', '/users/bob', { name: 'Bob' });
await talkjs('PUT', '/conversations/order_1001', { participants: ['shop', 'bob'], subject: 'Order #1001' });
await talkjs('POST', '/conversations/order_1001/messages', [
  { text: 'Hi Bob, your order shipped.', sender: 'shop', type: 'UserMessage' },
]);

REST calls take an admin token, and the REST API docs have your server make a new one for each request. Ours expire after 30 seconds. Every call returned 200 from Node, and the message showed up when we read the conversation back. If you retry a send, add an idempotencyKey to the message: TalkJS then sends it exactly once, and keeps the key for 24 hours. The default rate limit is 9 requests a second per app, with bursts of 500, shared by every server instance you run. You can ask us to raise it.