> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bijection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Module: services/node

> Reference for the bijection/services/node entry point.

## Type Aliases

### ServiceJwk

Ƭ **ServiceJwk**: `Object`

A P-256 private key as a JSON Web Key.

#### Type declaration

| Name | Type |
| :- | :- |
| `kty` | `"EC"` |
| `crv` | `"P-256"` |
| `x` | `string` |
| `y` | `string` |
| `d` | `string` |

***

### ServiceKey

Ƭ **ServiceKey**: `Object`

A service credential: the private key `bijection access credential
create` wrote, with the deployment it is installed on.

#### Type declaration

| Name | Type | Description |
| :- | :- | :- |
| `service` | `string` | - |
| `credential` | `string` | The credential's identifier, derived from its public key. |
| `deployment_url` | `string` | The deployment's API URL. |
| `key` | [`ServiceJwk`](/api/modules/services_node#servicejwk) | - |

***

### McpSessionHandle

Ƭ **McpSessionHandle**: `Object`

One conversation's session.

#### Type declaration

| Name | Type | Description |
| :- | :- | :- |
| `id` | `string` | The session's identifier on the deployment. |
| `url` | `string` | The server's endpoint: the URL the agent's host connects to. |
| `principal` | `string` | - |
| `actsFor` | `string` \| `null` | The object the session acts for, or null before verification. |
| `expiresAt` | `number` | - |
| `tools` | `string`\[] | The tools this session was offered when it started. |
| `token` | () => `string` | A bearer token for `url`, signed again as it nears expiry and never valid past the session. Give the agent's host this function, or its current value for a platform that takes one string. |
| `connect` | (`options`: \{ `store`: [`McpRequestStore`](/api/interfaces/mcp_node.McpRequestStore) ; `fetch?`: typeof `fetch`  }) => \{ `discover`: (`options?`: \{ `signal?`: `AbortSignal`  }) => `Promise`\<`any`> ; `fetchForCall`: (`callId`: `string`) => (`input`: `URL` \| `RequestInfo`, `init?`: `RequestInit`) => `Promise`\<`Response`>(`input`: `string` \| `URL` \| `Request`, `init?`: `RequestInit`) => `Promise`\<`Response`> ; `recover`: (`callId`: `string`, `request?`: \{ `signal?`: `AbortSignal`  }) => `Promise`\<`any`> ; `status`: (`callId`: `string`, `request?`: \{ `signal?`: `AbortSignal`  }) => `Promise`\<`any`>  } | A durable MCP connection for a host that calls operation tools: `fetchForCall(callId)`, `recover(callId)`, `status(callId)`, `discover()`. |
| `permissions` | () => `Promise`\<\{ `server`: `string` ; `acts_for`: \{ `type`: `string` ; `key`: `string`  } \| `null` ; `permissions`: `string`\[] ; `tools`: \{ `name`: `string` ; `state`: `"available"` \| `"changed"` \| `"removed"`  }\[] ; `expires_at`: `number`  }> | What the session may do right now on its object. |
| `verify` | (`actsFor`: `string`, `evidence?`: `null` \| \{ `method`: `string` ; `reference?`: `string`  }) => `Promise`\<[`McpSessionHandle`](/api/modules/services_node#mcpsessionhandle)> | Bind a session started before you verified the caller to the object you now verified them as, once, with your evidence. It then holds its role there, and every tool. |
| `end` | () => `Promise`\<`void`> | End the session now: the engine refuses its token from that commit on. |

## Functions

### credentialId

▸ **credentialId**(`x`, `y`): `string`

A credential's identifier: the first 16 hexadecimal digits of the SHA-256
of `key:<x>:<y>`, as the deployment derives it.

#### Parameters

| Name | Type |
| :- | :- |
| `x` | `string` |
| `y` | `string` |

#### Returns

`string`

***

### decodeServiceKey

▸ **decodeServiceKey**(`text`): [`ServiceKey`](/api/modules/services_node#servicekey)

Read the one-line credential `bijection access credential create`
wrote.

#### Parameters

| Name | Type |
| :- | :- |
| `text` | `string` |

#### Returns

[`ServiceKey`](/api/modules/services_node#servicekey)

***

### encodeServiceKey

▸ **encodeServiceKey**(`key`): `string`

The one-line form of a credential, for a secret store.

#### Parameters

| Name | Type |
| :- | :- |
| `key` | [`ServiceKey`](/api/modules/services_node#servicekey) |

#### Returns

`string`

***

### generateServiceKey

▸ **generateServiceKey**(`options`): `Object`

Create a credential of `service` and the public key to install on the
deployment (`POST /api/credentials/install`). `bijection access credential
create` does both; this is for tools that manage keys themselves.

#### Parameters

| Name | Type |
| :- | :- |
| `options` | `Object` |
| `options.service` | `string` |
| `options.deploymentUrl` | `string` |

#### Returns

`Object`

| Name | Type |
| :- | :- |
| `key` | [`ServiceKey`](/api/modules/services_node#servicekey) |
| `installed` | \{ `kind`: `"key"` ; `service`: `string` ; `x`: `string` ; `y`: `string`  } |
| `installed.kind` | `"key"` |
| `installed.service` | `string` |
| `installed.x` | `string` |
| `installed.y` | `string` |

***

### signServiceToken

▸ **signServiceToken**(`key`, `subject`, `options`): `string`

Sign a token under the service's issuer: `service` for the service
itself, or `session:<id>` for one of its issued sessions. The deployment
verifies it against the installed credential.

#### Parameters

| Name | Type |
| :- | :- |
| `key` | [`ServiceKey`](/api/modules/services_node#servicekey) |
| `subject` | `string` |
| `options` | `Object` |
| `options.lifetimeSeconds` | `number` |
| `options.now?` | `number` |

#### Returns

`string`

***

### serviceClient

▸ **serviceClient**(`options`): `Object`

Hold one credential of a service. `credential` is the one-line
credential or its decoded form; `module` is where the deployment exports
`mcpModule` (default `mcp`).

#### Parameters

| Name | Type |
| :- | :- |
| `options` | `Object` |
| `options.credential` | `string` \| [`ServiceKey`](/api/modules/services_node#servicekey) |
| `options.module?` | `string` |
| `options.fetch?` | (`input`: `URL` \| `RequestInfo`, `init?`: `RequestInit`) => `Promise`\<`Response`>(`input`: `string` \| `URL` \| `Request`, `init?`: `RequestInit`) => `Promise`\<`Response`> |

#### Returns

`Object`

| Name | Type |
| :- | :- |
| `service` | `string` |
| `credential` | `string` |
| `token` | () => `string` |
| `client` | () => [`BijectionHttpClient`](/api/classes/browser.BijectionHttpClient) |
| `startSession` | (`server`: `string`, `input`: \{ `actsFor`: `null` \| `string` ; `channel?`: `string` ; `evidence?`: `null` \| \{ `method`: `string` ; `reference?`: `string`  } ; `lifetimeMs?`: `number` ; `id?`: `string`  }) => `Promise`\<[`McpSessionHandle`](/api/modules/services_node#mcpsessionhandle)> |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.