> For the complete documentation index, see [llms.txt](https://docs.payments.thalescloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.payments.thalescloud.io/payment-passkeys-issuers/integrate-d1-javascript-sdk.md).

# Integrate D1 Javascript SDK

This page describes how the issuer can integrate the D1 Javascript SDK that is needed for managing Visa Payment Passkeys.

### D1 Javascript SDK versioning and subresource integrity

#### Script versioning and Subresource Integrity <a href="#hldwebfrontendinteractions-scriptversioningandsubresourceintegrity" id="hldwebfrontendinteractions-scriptversioningandsubresourceintegrity"></a>

The Thales JavaScript is published as an **immutable, version-named** bundle:

[https://client-api.d1.thalescloud.io/passkey/visa-pp-\<major>.\<minor>.\<patch>.js](https://client-api.d1.thalescloud.io/passkey/visa-pp-<major>.<minor>.<patch>.js)

* **The bytes behind a published URL never change.** Each version is a distinct, permanent artifact. Responses are served with `Cache-Control: public, max-age=31536000, immutable` and `Access-Control-Allow-Origin: *` (the CORS header is what makes SRI possible on a cross-origin script).
* **There is deliberately no `latest` or unversioned URL.** Only version-named files are served; any other path returns `404`. An alias whose content could change would break every page that pinned a hash against it, which is precisely what SRI exists to prevent.
* **The integrity hash stays valid for the lifetime of that version.** Because the bytes are immutable, an issuer page never needs to update its hash unless it deliberately moves to a new version.
* **The integrity hash is environment-specific.** The VISA hub URL is compiled into the bundle at build time, so the sandbox build and the production build are different bytes and therefore have **different hashes**. Always use the pair supplied for the target environment; never copy a hash from one environment to another.

Thales provides the exact `{ URL, integrity }` pair per environment during onboarding, and again whenever a new version is published.

**Updating to a new version** is a two-attribute change in the issuer page: replace the `src` and the `integrity` values with the new pair. Nothing else in the integration changes.

**If the hash does not match the bytes**, the browser refuses to execute the script and `window.init` is never defined. This is why the fail-closed check in the example is mandatory: the page must show an error rather than stall silently.

Production

<table><thead><tr><th width="100">Version</th><th>Integrity (sha384)</th><th>Published</th><th width="100">Status</th></tr></thead><tbody><tr><td><strong>1.0.3</strong></td><td><code>sha384-We9DyngTdnslfSlTBZs9Oak4E7MbMhwgdp84+q8Jy2NUv9IwGjZLn2Y4yxIhWH+c</code></td><td>2026-08-14</td><td><strong>Current</strong></td></tr></tbody></table>

Pre-production

<table><thead><tr><th width="100">Version</th><th>Integrity (sha384)</th><th>Published</th><th width="100">Status</th></tr></thead><tbody><tr><td><strong>1.0.3</strong></td><td><code>sha384-ZuoWRFeTDtDywe0P/j+uM8P/wmLNS7L905osSN9I6JMOAL3iCz3a+U8PuICtBN2k</code></td><td>2026-08-14</td><td><strong>Current</strong></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.payments.thalescloud.io/payment-passkeys-issuers/integrate-d1-javascript-sdk.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.