Sell the file. Keep the key private.

import {
  createBitUnlockSandboxClient,
  createSandboxSession
} from "@bitunlock/sdk";

const endpoint = "https://sandbox.unlock.example";
const session = await createSandboxSession(endpoint);
const sandbox = createBitUnlockSandboxClient({
  endpoint,
  sessionId: session.sessionId,
  controlToken: session.token,
  signer: window.nostr.signEvent
});

// Use sandbox.client for normal signed v1 calls.
// The bearer token is sent only to control routes.

import { createBitUnlockClient } from "@bitunlock/sdk";

const client = createBitUnlockClient({
  endpoint: "https://unlock.example",
  expectedServicePubkey: "<64-hex-service-pubkey>",
  signer: window.nostr.signEvent
});

const { document } = await client.discoverPolicy();
console.log(document.policyVersion);

// Reuse idempotency keys only for exact retries.
// Render and pay every leg returned by createQuote().

npm run conformance -- \
  --endpoint https://unlock.example \
  --service-pubkey <64-hex-service-pubkey>

# Verifies signed policy and the pinned identity.
# Checks headers, OpenAPI, security contact,
# and fail-closed NIP-98 authorization.
# No nsec, NWC URI, or payment secret is accepted.