Quickstart
From nothing to a signed-in app that stores data — one key, one install, a dozen lines. No server, no SQL, no security rules to write.
Step 0 — get your app key
Every call needs an app key (pk_...). Sign in at
app.gemmein.com with an email code — free, no card —
and copy the key from the Setup page. That page also gives you a ready-made prompt
that teaches this whole SDK to your AI tool.
Building with an AI? Paste the Setup-page prompt and it knows the entire surface — the SDK is small enough to be taught in one prompt. The full machine guide also ships inside the package itself.
Install
npm i @gemmein/sdk
No bundler? The SDK is dependency-free pure ESM — copy
dist/index.js from the package next to your HTML and import it from a
<script type="module">. Works on any static host.
Quick start
import { gemmein } from "@gemmein/sdk"
const g = gemmein("pk_test_...")
// Login — email code, no passwords
await g.auth.sendEmailCode("user@example.com")
await g.auth.verifyEmailCode({ email: "user@example.com", code: "12345678" })
// Store data — rules enforced server-side
await g.collection("tasks").create({ title: "Buy milk", done: false })
const { records } = await g.collection("tasks").list()
Sessions persist across page reloads automatically. One session per user: verifying a
new code revokes that email's older sessions — a stale token throws
auth_expired once, the SDK clears it, and a retry (or re-auth) recovers.
The one thing that trips everyone up
Records come back wrapped — your fields live under .data:
const task = await tasks.create({ title: "Buy milk", done: false })
// { id, data: { title, done }, createdAt, updatedAt, ... }
task.data.title // ✓ "Buy milk"
task.title // ✗ undefined — if your UI shows blanks, this is why
Collections are created in the dashboard, never by the
SDK. A 404 unknown_collection means it doesn't exist yet — add it on the
dashboard's data page (one click) and pick its rule. Names are lowercase letters, numbers
and underscores only: saved_games, never savedGames — a bad name
throws the moment collection() is called.
Where next
- Data & the rules — pick the right safety rule for each collection.
- Auth & sessions — the full sign-in surface.
- Payments — charge for things without building a webhook.
- Reaffirm — prove your app's boundaries in CI.