---
title: "Setup SDK Client for Store"
description: "Setting up an OpenFGA SDK client"
canonical: "https://openfga.dev/docs/getting-started/setup-sdk-client"
content_type: "documentation"
last_updated: "2026-09-07T11:16:10.000Z"
---

# Setup SDK Client for Store

This article explains how to build an OpenFGA client by using the SDKs.

The first step is to ensure that you have created a store by following [these steps](https://openfga.dev/docs/getting-started/create-store.md).

Next, depending on the authentication scheme you want to use, there are different ways to build the client.

## Using No Authentication

This is a simple setup but it is not recommended for production use.

- Node.js
- Go
- .NET
- Python
- Java
- CLI

```
const { OpenFgaClient } = require('@openfga/sdk'); // OR import { OpenFgaClient } from '@openfga/sdk';



const openFga = new OpenFgaClient({

  apiUrl: process.env.FGA_API_URL, // required, e.g. https://api.fga.example

  storeId: process.env.FGA_STORE_ID,

  authorizationModelId: process.env.FGA_MODEL_ID, // Optional, can be overridden per request

});
```

```
import (

    "os"



    . "github.com/openfga/go-sdk/client"

)



func main() {

    fgaClient, err := NewSdkClient(&ClientConfiguration{

        ApiUrl:               os.Getenv("FGA_API_URL"), // required, e.g. https://api.fga.example

        StoreId:              os.Getenv("FGA_STORE_ID"), // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),  // Optional, can be overridden per request

    })



    if err != nil {

        // .. Handle error

    }

}
```

```
using OpenFga.Sdk.Client;

using OpenFga.Sdk.Client.Model;

using OpenFga.Sdk.Model;

using Environment = System.Environment;



namespace ExampleApp;



class MyProgram {

    static async Task Main() {

        var configuration = new ClientConfiguration() {

            ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL") ?? "http://localhost:8080", // required, e.g. https://api.fga.example

            StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

            AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // optional, can be overridden per request

        };

        var fgaClient = new OpenFgaClient(configuration);

    }

}
```

```
import asyncio

import os

import openfga_sdk

from openfga_sdk.client import OpenFgaClient



async def main():

    configuration = openfga_sdk.ClientConfiguration(

        api_url = os.environ.get('FGA_API_URL'), # required, e.g. https://api.fga.example

        store_id = os.environ.get('FGA_STORE_ID'), # optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

        authorization_model_id = os.environ.get('FGA_MODEL_ID'), # Optional, can be overridden per request

    )



    async with OpenFgaClient(configuration) as fga_client:

        api_response = await fga_client.read_authorization_models() # call requests

        await fga_client.close() # close when done



asyncio.run(main())
```

```
import dev.openfga.sdk.api.client.OpenFgaClient;

import dev.openfga.sdk.api.configuration.ClientConfiguration;



public class Example {

    public static void main(String[] args) {

        var config = new ClientConfiguration()

                .apiUrl(System.getenv("FGA_API_URL")) // If not specified, will default to "https://localhost:8080"

                .storeId(System.getenv("FGA_STORE_ID")) // Not required when calling createStore() or listStores()

                .authorizationModelId(System.getenv("FGA_AUTHORIZATION_MODEL_ID")); // Optional, can be overridden per request



        var fgaClient = new OpenFgaClient(config);

    }

}
```

```
export FGA_API_URL=https://api.fga.example # optional. Defaults to http://localhost:8080

export FGA_STORE_ID=YOUR_STORE_ID # required for all calls except \`store create\`, \`store list\` and \`model validate\`

export FGA_MODEL_ID=YOUR_MODEL_ID # optional, can be overridden per request, latest is used if this is empty
```

## Using shared key authentication

If you want to use shared key authentication, you need to generate a random string that will work as secret and set that key when building your OpenFGA server. Then, when building the client, set it as environment variable `FGA_API_TOKEN`.

Warning

If you are going to use this setup in production, you should enable TLS in your OpenFGA server. Please see the [Running OpenFGA in Production](https://openfga.dev/docs/best-practices/running-in-production.md).

- Node.js
- Go
- .NET
- Python
- Java
- CLI

```
const { CredentialsMethod, OpenFgaClient } = require('@openfga/sdk'); // OR import { CredentialsMethod, OpenFgaClient } from '@openfga/sdk';



const openFga = new OpenFgaClient({

    apiUrl: process.env.FGA_API_URL, // required, e.g. https://api.fga.example

    storeId: process.env.FGA_STORE_ID, // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

    authorizationModelId: process.env.FGA_MODEL_ID, // optional, can be overridden per request

    credentials: {

        method: CredentialsMethod.ApiToken,

        config: {

            token: process.env.$FGA_API_TOKEN,

        },

    }

});
```

```
import (

    "os"



    . "github.com/openfga/go-sdk/client"

    "github.com/openfga/go-sdk/credentials"

)



func main() {

    fgaClient, err := NewSdkClient(&ClientConfiguration{

        ApiUrl:               os.Getenv("FGA_API_URL"), // required, e.g. https://api.fga.example

        StoreId:              os.Getenv("FGA_STORE_ID"),   // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),   // optional, can be overridden per request

        Credentials: &credentials.Credentials{

            Method: credentials.CredentialsMethodApiToken,

            Config: &credentials.Config{

                ApiToken: os.Getenv("OPENFGA_API_TOKEN"), // will be passed as the "Authorization: Bearer ${ApiToken}" request header

            },

        },

    })



    if err != nil {

        // .. Handle error

    }

}
```

```
using OpenFga.Sdk.Client;

using OpenFga.Sdk.Configuration;

using Environment = System.Environment;



namespace ExampleApp;



class MyProgram {

    static async Task Main() {

        var configuration = new ClientConfiguration() {

            ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL") ?? "http://localhost:8080", // required, e.g. https://api.fga.example

            StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

            AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // optional, can be overridden per request

            Credentials = new Credentials() {

                Method = CredentialsMethod.ApiToken,

                Config = new CredentialsConfig() {

                    ApiToken = Environment.GetEnvironmentVariable("FGA_API_TOKEN")

                },

            },

        };

        var fgaClient = new OpenFgaClient(configuration);

    }

}
```

```
import asyncio

import os

import openfga_sdk

from openfga_sdk.client import OpenFgaClient

from openfga_sdk.credentials import Credentials, CredentialConfiguration



async def main():



    credentials = Credentials(

        method='api_token',

        configuration=CredentialConfiguration(

            api_token=os.environ.get('FGA_API_TOKEN')

        )

    )

    configuration = openfga_sdk.ClientConfiguration(

        api_url = os.environ.get('FGA_API_URL'), # required, e.g. https://api.fga.example

        store_id = os.environ.get('FGA_STORE_ID'), # optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

        authorization_model_id = os.environ.get('FGA_MODEL_ID'), # Optional, can be overridden per request

        credentials = credentials,

    )



    async with OpenFgaClient(configuration) as fga_client:

        api_response = await fga_client.read_authorization_models() # call requests

        await fga_client.close() # close when done



asyncio.run(main())
```

```
import dev.openfga.sdk.api.client.OpenFgaClient;

import dev.openfga.sdk.api.configuration.ApiToken;

import dev.openfga.sdk.api.configuration.ClientConfiguration;

import dev.openfga.sdk.api.configuration.Credentials;



public class Example {

    public static void main(String[] args) {

        var config = new ClientConfiguration()

                .apiUrl(System.getenv("FGA_API_URL")) // If not specified, will default to "https://localhost:8080"

                .storeId(System.getenv("FGA_STORE_ID")) // Not required when calling createStore() or listStores()

                .authorizationModelId(System.getenv("FGA_AUTHORIZATION_MODEL_ID")) // Optional, can be overridden per request

                .credentials(new Credentials(

                    new ApiToken(System.getenv("FGA_API_TOKEN")) // will be passed as the "Authorization: Bearer ${ApiToken}" request header

                ));



        var fgaClient = new OpenFgaClient(config);

    }

}
```

```
export FGA_API_URL=https://api.fga.example # optional. Defaults to http://localhost:8080

export FGA_STORE_ID=YOUR_STORE_ID # required for all calls except \`store create\`, \`store list\` and \`model validate\`

export FGA_MODEL_ID=YOUR_MODEL_ID # optional, can be overridden per request, latest is used if this is empty

export FGA_API_TOKEN=YOUR_API_TOKEN
```

## Using client credentials flow

Note

The OpenFGA server does not support the client credentials flow, however if you or your OpenFGA provider have implemented a client credentials wrapper on top, follow the instructions here to have the OpenFGA client handle the token exchange for you.

- Node.js
- Go
- .NET
- Python
- Java
- CLI

```
const { CredentialsMethod, OpenFgaClient } = require('@openfga/sdk'); // OR import { CredentialsMethod, OpenFgaClient } from '@openfga/sdk';



const openFga = new OpenFgaClient({

    apiUrl: process.env.FGA_API_URL, // required, e.g. https://api.fga.example

    storeId: process.env.FGA_STORE_ID, // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

    authorizationModelId: process.env.FGA_MODEL_ID, // optional, can be overridden per request

    credentials: {

        method: CredentialsMethod.ClientCredentials,

        config: {

          apiTokenIssuer: process.env.FGA_API_TOKEN_ISSUER,

          apiAudience: process.env.FGA_API_AUDIENCE,

          clientId: process.env.FGA_CLIENT_ID,

          clientSecret: process.env.FGA_CLIENT_SECRET,

        },

    }

});
```

```
import (

    "os"



    . "github.com/openfga/go-sdk/client"

    "github.com/openfga/go-sdk/credentials"

)



func main() {

    fgaClient, err := NewSdkClient(&ClientConfiguration{

        ApiUrl:               os.Getenv("FGA_API_URL"), // required, e.g. https://api.fga.example

        StoreId:              os.Getenv("FGA_STORE_ID"),   // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

        AuthorizationModelId: os.Getenv("FGA_MODEL_ID"),   // optional, can be overridden per request

        Credentials: &credentials.Credentials{

            Method: credentials.CredentialsMethodClientCredentials,

            Config: &credentials.Config{

                ClientCredentialsClientId:       os.Getenv("FGA_CLIENT_ID"),

                ClientCredentialsClientSecret:   os.Getenv("FGA_CLIENT_SECRET"),

                ClientCredentialsApiAudience:    os.Getenv("FGA_API_AUDIENCE"),

                ClientCredentialsApiTokenIssuer: os.Getenv("FGA_API_TOKEN_ISSUER"),

            },

        },

    })



    if err != nil {

        // .. Handle error

    }

}
```

```
using OpenFga.Sdk.Client;

using OpenFga.Sdk.Configuration;

using Environment = System.Environment;



namespace ExampleApp;



class MyProgram {

    static async Task Main() {

        var configuration = new ClientConfiguration() {

            ApiUrl = Environment.GetEnvironmentVariable("FGA_API_URL") ?? "http://localhost:8080", // required, e.g. https://api.fga.example

            StoreId = Environment.GetEnvironmentVariable("FGA_STORE_ID"), // optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

            AuthorizationModelId = Environment.GetEnvironmentVariable("FGA_MODEL_ID"), // optional, can be overridden per request

            Credentials = new Credentials() {

                Method = CredentialsMethod.ClientCredentials,

                Config = new CredentialsConfig() {

                    ApiTokenIssuer = Environment.GetEnvironmentVariable("FGA_API_TOKEN_ISSUER"),

                    ApiAudience = Environment.GetEnvironmentVariable("FGA_API_AUDIENCE"),

                    ClientId = Environment.GetEnvironmentVariable("FGA_CLIENT_ID"),

                    ClientSecret = Environment.GetEnvironmentVariable("FGA_CLIENT_SECRET"),

                }

            }

        };

        var fgaClient = new OpenFgaClient(configuration);

    }

}
```

```
import asyncio

import os

import openfga_sdk

from openfga_sdk.client import OpenFgaClient

from openfga_sdk.credentials import Credentials, CredentialConfiguration



async def main():



    credentials = Credentials(

        method='client_credentials',

        configuration=CredentialConfiguration(

            api_issuer= os.environ.get('FGA_API_TOKEN_ISSUER'),

            api_audience= os.environ.get('FGA_API_AUDIENCE'),

            client_id= os.environ.get('FGA_CLIENT_ID'),

            client_secret= os.environ.get('FGA_CLIENT_SECRET'),

        )

    )

    configuration = openfga_sdk.ClientConfiguration(

        api_url = os.environ.get('FGA_API_URL'), # required, e.g. https://api.fga.example

        store_id = os.environ.get('FGA_STORE_ID'), # optional, not needed for \`CreateStore\` and \`ListStores\`, required before calling for all other methods

        authorization_model_id = os.environ.get('FGA_MODEL_ID'), # Optional, can be overridden per request

        credentials = credentials,

    )



    async with OpenFgaClient(configuration) as fga_client:

        api_response = await fga_client.read_authorization_models() # call requests

        await fga_client.close() # close when done



asyncio.run(main())
```

```
import dev.openfga.sdk.api.client.OpenFgaClient;

import dev.openfga.sdk.api.configuration.ClientConfiguration;

import dev.openfga.sdk.api.configuration.ClientCredentials;

import dev.openfga.sdk.api.configuration.Credentials;



public class Example {

    public static void main(String[] args) {

        var config = new ClientConfiguration()

                .apiUrl(System.getenv("FGA_API_URL")) // If not specified, will default to "https://localhost:8080"

                .storeId(System.getenv("FGA_STORE_ID")) // Not required when calling createStore() or listStores()

                .authorizationModelId(System.getenv("FGA_AUTHORIZATION_MODEL_ID")) // Optional, can be overridden per request

                .credentials(new Credentials(

                    new ClientCredentials()

                            .apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER"))

                            .apiAudience(System.getenv("FGA_API_AUDIENCE"))

                            .clientId(System.getenv("FGA_CLIENT_ID"))

                            .clientSecret(System.getenv("FGA_CLIENT_SECRET"))

                ));



        var fgaClient = new OpenFgaClient(config);

    }

}
```

```
export FGA_API_URL=https://api.fga.example # optional. Defaults to http://localhost:8080

export FGA_STORE_ID=YOUR_STORE_ID # required for all calls except \`store create\`, \`store list\` and \`model validate\`

export FGA_MODEL_ID=YOUR_MODEL_ID # optional, can be overridden per request, latest is used if this is empty

export FGA_API_TOKEN_ISSUER=YOUR_API_TOKEN_ISSUER

export FGA_API_AUDIENCE=YOUR_API_AUDIENCE

export FGA_CLIENT_ID=YOUR_CLIENT_ID

export FGA_CLIENT_SECRET=YOUR_CLIENT_SECRET
```