Integrate D1 Javascript SDK

This page describes how the issuer can integrate the D1 Javascript SDK that is needed for managing Visa Payment Passkeys.

D1 Javascript SDK versioning and subresource integrity

Script versioning and Subresource Integrity

The Thales JavaScript is published as an immutable, version-named bundle:

https://client-api.d1.thalescloud.io/passkey/visa-pp-<major>.<minor>.<patch>.js

• The bytes behind a published URL never change. Each version is a distinct, permanent artifact. Responses are served with Cache-Control: public, max-age=31536000, immutable and Access-Control-Allow-Origin: * (the CORS header is what makes SRI possible on a cross-origin script).

• There is deliberately no latest or unversioned URL. Only version-named files are served; any other path returns 404. An alias whose content could change would break every page that pinned a hash against it, which is precisely what SRI exists to prevent.

• The integrity hash stays valid for the lifetime of that version. Because the bytes are immutable, an issuer page never needs to update its hash unless it deliberately moves to a new version.

• The integrity hash is environment-specific. The VISA hub URL is compiled into the bundle at build time, so the sandbox build and the production build are different bytes and therefore have different hashes. Always use the pair supplied for the target environment; never copy a hash from one environment to another.

Thales provides the exact { URL, integrity } pair per environment during onboarding, and again whenever a new version is published.

Updating to a new version is a two-attribute change in the issuer page: replace the src and the integrity values with the new pair. Nothing else in the integration changes.

If the hash does not match the bytes, the browser refuses to execute the script and window.init is never defined. This is why the fail-closed check in the example is mandatory: the page must show an error rather than stall silently.

Production

Version	Integrity (sha384)	Published	Status
1.0.3	sha384-We9DyngTdnslfSlTBZs9Oak4E7MbMhwgdp84+q8Jy2NUv9IwGjZLn2Y4yxIhWH+c	2026-08-14	Current

Pre-production

Version	Integrity (sha384)	Published	Status
1.0.3	sha384-ZuoWRFeTDtDywe0P/j+uM8P/wmLNS7L905osSN9I6JMOAL3iCz3a+U8PuICtBN2k	2026-08-14	Current