The pattern: a small branded npm package that wraps the site surface.
Updated
A platform that builds many client sites wants every site to consume the surface the same way. The pattern: publish a small, branded package (private repo, installed from GitHub — never npm) that wraps /api/site/*:
npm install github:<org>/<platform>-sdk
content, files, products, categories, locations, forms, leads, insights, whoami.<img>. Ship it from a subpath so the client component stays out of server entries, and note transpilePackages if it ships JSX.# .env — server only, never NEXT_PUBLIC_*
LPS_SITE_KEY=dfd-site-secret-key-live-…
# browser, when needed
NEXT_PUBLIC_LPS_SITE_KEY=dfd-site-public-key-live-…
# local development against a local backend
LPS_API_URL=http://localhost:8000
Test-environment keys skip the origin allowlist so localhost just works — put those in development env files and nothing else.
A GitHub-installed dependency updates when the consuming site reinstalls — push to the SDK repo, then reinstall in each site (managed deploys can force latest on build). Treat the SDK's README as the contract each site developer reads first.