SDK

@marca/sdk is a typed client for the Marca API, generated from its OpenAPI document. It has no runtime dependencies and runs in Node 18+, Bun and Deno. Use it from your backend — never put an API key in browser code.

npm install @marca/sdk

Use it

import { createMarcaClient, MarcaError } from '@marca/sdk';

const marca = createMarcaClient({
  endpoint: 'https://marca.dev',
  project: 'proj_…',
  token: process.env.MARCA_API_KEY!,   // sk_live_… (or an agent token, rev_…)
  onBehalfOf: '[email protected]',         // API keys: who writes are attributed to
});

const task = await marca.tasks.create({ route: '/pricing', instruction: 'Raise the CTA contrast', priority: 'high' });
await marca.tasks.comment(task.id, { body: 'Picked up by the release bot.' });
await marca.tasks.update(task.id, { status: 'in_review' });

const open = await marca.items.list('open');

try {
  await marca.tasks.update(task.id, { status: 'done' });
} catch (err) {
  if (err instanceof MarcaError && err.code === 'forbidden_for_reviewer') {
    // the member this key acts for can't change status
  }
}

Area	Methods
Identity	`whoami()`
Tasks	`tasks.list({ includeSubtasks })`, `tasks.get(id)`, `tasks.create(input)`, `tasks.update(id, patch)`, `tasks.bulkStatus(ids, status)`, `tasks.createSubtask(id, input)`, `tasks.comment(id, input)`
Review feed	`items.list(status)`
Comments	`comments.list()`, `comments.create(input)`
Webhooks	`webhooks.list()`, `webhooks.create(input)`, `webhooks.update(id, patch)`, `webhooks.delete(id)`, `webhooks.deliveries(id)`, `webhooks.redeliver(id, deliveryId)`, `webhooks.test(id)`
Anything else	`request(method, path, body?)`

Every failure throws MarcaError with the HTTP status, Marca's code (insufficient_scope, on_behalf_of_not_member, forbidden_for_reviewer, not_found, …), the response body, and retryAfterSeconds on a 429.

Receive webhooks

import { parseWebhook, verifyWebhookSignature } from '@marca/sdk';

// rawBody must be the exact bytes Marca sent, not re-serialised JSON.
const event = await parseWebhook(process.env.MARCA_WEBHOOK_SECRET!, rawBody, request.headers.get('x-marca-signature'));

parseWebhook throws on a bad or stale signature; verifyWebhookSignature returns a boolean. See Webhooks for events and payloads.