Install via CDN

Install the SDK via CDN for static HTML, CMS templates, tag managers, and prototypes that cannot install an npm package. The CDN file contains the same Board SDK implementation as one classic script. Applications with a package manager should keep using the npm package: those imports are typed and tree-shakeable, while the CDN build is downloaded in full.

Production installation

Pin an exact package version and the SHA-384 value published for that release:

123456789101112
<script
  src="https://cdn.jsdelivr.net/npm/@cavuno/board@4.4.0/dist/browser/cavuno-board.global.min.js"
  integrity="sha384-tyurP0K/LUeaFZGfebA3Wv8pHpBocjLTv9O2v9ees5wLH4KnehfhaqUyL0YvG8w7"
  crossorigin="anonymous"
></script>
<script nonce="<page-csp-nonce>">
  const board = CavunoBoard.createBoardClient({ board: 'pk_example' });

  board.jobs.list({ limit: 20 }).then(({ data }) => {
    console.log(data);
  });
</script>

The equivalent UNPKG installation uses the same verified bytes and hash:

12345
<script
  src="https://unpkg.com/@cavuno/board@4.4.0/dist/browser/cavuno-board.global.min.js"
  integrity="sha384-tyurP0K/LUeaFZGfebA3Wv8pHpBocjLTv9O2v9ees5wLH4KnehfhaqUyL0YvG8w7"
  crossorigin="anonymous"
></script>

The 4.4.0 bytes and integrity value above were verified after publication on npm, jsDelivr, and UNPKG. Do not combine a mutable version with SRI, and never use an unversioned or latest URL.

Prototype installation

For a disposable prototype, pin the current major and omit SRI because the bytes may change within that major:

1234
<script src="https://cdn.jsdelivr.net/npm/@cavuno/board@4/dist/browser/cavuno-board.global.min.js"></script>
<script>
  const board = CavunoBoard.createBoardClient({ board: 'pk_example' });
</script>

Move to an exact version and verified SRI before production.

Global API

The script installs one global, globalThis.CavunoBoard. Root SDK values retain their module names, including createBoardClient, BoardClient, paginate, typed error classes and guards, and SDK_VERSION. Browser-safe helper subpaths are grouped by their package boundaries:

12345678
const board = CavunoBoard.createBoardClient({ board: 'pk_example' });

console.log(CavunoBoard.SDK_VERSION);
CavunoBoard.format;
CavunoBoard.filters;
CavunoBoard.suggest;
CavunoBoard.seo;
CavunoBoard.paths;

Every runtime export from @cavuno/board/format, /filters, /suggest, /seo, and /paths appears in the matching namespace. There is no CavunoBoard.helpers layer. Loading multiple versions on one page is unsupported; normal classic-script behavior leaves the last-loaded CavunoBoard active, and SDK_VERSION identifies it.

The global deliberately excludes Node- and build-oriented entries: doctor, skills, server, sitemap, go, route-contract, well-known, and the CLI.

Errors and authentication storage

SDK failures use the same BoardApiError and guards as module consumers:

123456789
try {
  await board.jobs.retrieve('missing-job');
} catch (error) {
  if (CavunoBoard.isNotFound(error)) {
    console.log('Job not found');
  } else {
    console.error(error.requestId, error.code);
  }
}

Only pk_… publishable board keys belong in browser code. Never expose an operator key, admin secret, private environment value, or pre-issued bearer token in HTML or a CMS field.

Browser auth defaults to memory storage. Choose persistence explicitly:

1234
const board = CavunoBoard.createBoardClient({
  board: 'pk_example',
  auth: { storage: 'session' }, // or 'memory' / 'local'
});

session survives a reload in one tab. local persists across tabs and for longer, increasing the impact of any script injection. Under SSR, prefer a framework-owned httpOnly cookie and the npm package rather than browser-owned tokens.

Content security policy

Allow the chosen asset CDN and the Board API:

1
Content-Security-Policy: script-src 'self' 'nonce-<page-csp-nonce>' https://cdn.jsdelivr.net; connect-src 'self' https://api.cavuno.com

If script-src-elem is present, allow the CDN there too. Strict CSP must authorize initialization with the page's nonce or hash, or move it to an external file. Do not add 'unsafe-inline'. When using UNPKG, replace the script origin with https://unpkg.com.

Self-hosting and compatibility

You may serve the exact file from your own origin. Copy dist/browser/cavuno-board.global.min.js from the packed npm version, keep its filename and SDK version together, and generate SRI from the bytes you actually deploy.

The bundle targets ES2020 and includes no polyfills. Cavuno supports the latest two stable Chrome, Edge, Firefox, and Safari releases. It requires native fetch, URL, URLSearchParams, Headers, FormData, and Promises. Internet Explorer is not supported.

Verify the installation

Open the deployed page in a supported browser and confirm CavunoBoard.SDK_VERSION matches the pinned package version. In the network panel, verify the script response passes SRI, the Board API request reaches https://api.cavuno.com, and authenticated requests use an Authorization header without exposing its value in logs. A missing global usually means CSP blocked the CDN or the URL does not name a published exact version.

For typed imports and selective helper loading, install the SDK as a package. For browser token decisions, continue with Client-side applications.