The Merion API is a standard HTTPS/JSON API with OIDC authentication. Any HTTP client that supports JSON and can set request headers works. The recommendations below cover the most common integration patterns.

OIDC and JWT libraries

These libraries handle the OIDC authorisation code flow, PKCE S256 challenge generation, JWT signature verification (ES256), and JWKS fetching. Use a battle-tested library — do not implement JWT verification from scratch.

JavaScript / TypeScript

jose — github.com/panva/jose: Comprehensive JWT/JWK implementation for Node.js and browser. Supports ES256, JWKS fetching by URI, and all standard JWT claims validation. The most widely used choice for the Merion auth flow.

npm install jose

import { createRemoteJWKSet, jwtVerify } from "jose";

// Fetch JWKS URI from OIDC discovery document first
const JWKS = createRemoteJWKSet(
  new URL("https://auth.merion.com.au/jwks")
);

const { payload } = await jwtVerify(accessToken, JWKS, {
  issuer:   "https://auth.merion.com.au", // from discovery doc
  audience: "YOUR_CLIENT_ID",
  algorithms: ["ES256"],
});

Python

python-jose — github.com/mpdavis/python-jose: Supports ES256 and JWKS. Install with the cryptography extra for elliptic-curve support.

pip install python-jose[cryptography] requests

import requests
from jose import jwt, jwk

# Fetch JWKS
oidc_config = requests.get(
    "https://auth.merion.com.au/.well-known/openid-configuration"
).json()
jwks = requests.get(oidc_config["jwks_uri"]).json()

claims = jwt.decode(
    access_token,
    jwks,
    algorithms=["ES256"],
    audience="YOUR_CLIENT_ID",
    issuer=oidc_config["issuer"],
)

PHP

web-token/jwt-framework — github.com/web-token/jwt-framework: Full JWT/JWK implementation for PHP 8. Supports ES256 and JWKS fetching.

composer require web-token/jwt-framework

Go

go-jose — github.com/go-jose/go-jose: JOSE/JWK/JWT implementation for Go. Supports ES256.

go get github.com/go-jose/go-jose/v3

OpenAPI client generation

The Merion API OpenAPI spec at https://api.merion.com.au/openapi.yaml can be used to generate a typed HTTP client in your language. See the OpenAPI Specification page for full instructions. Recommended tools:

openapi-generator-cli: 50+ target languages including TypeScript, PHP, Go, Python, Ruby, Java, and C#. github.com/OpenAPITools/openapi-generator
openapi-typescript: TypeScript-only; generates types without a runtime. Pair with openapi-fetch for a zero-overhead typed client. github.com/openapi-ts/openapi-typescript
Microsoft Kiota: Generates typed clients for TypeScript, C#, Python, Java, Go, and PHP from any OpenAPI spec. github.com/microsoft/kiota

HTTP clients

For the Forms API (no authentication required), any HTTP client works. For authenticated endpoints, choose a client that supports custom headers and can be composed with token refresh logic.

JavaScript / TypeScript: Native fetch (Node 18+ or browser), or ky for retry/timeout helpers. No additional libraries required for the Forms API.
Python: httpx or requests. Both support JSON bodies, custom headers, and timeout configuration.
PHP: Guzzle (guzzlehttp/guzzle) or native cURL. Guzzle has first-class middleware support for token refresh.
Go: Standard net/http package with golang.org/x/oauth2 for token management.

API testing tools

Postman: Import the spec directly from https://api.merion.com.au/openapi.yaml. Set up an environment with baseUrl and bearerToken variables to test all endpoints interactively.
Insomnia: Import via URL. Insomnia supports OIDC auth flows natively — configure it with the discovery document URL and your client credentials.
curl: All examples in this documentation use curl. No installation needed on macOS or most Linux distributions.
Spectral: Lint the OpenAPI spec for conformance. Useful for detecting schema drift between the spec and your integration. spectral lint https://api.merion.com.au/openapi.yaml

A note on first-party SDKs

Merion does not currently publish first-party language SDKs. Given that the API surface is well-documented in OpenAPI 3.x and uses standard OIDC, we recommend generating a client from the spec using one of the tools above rather than waiting for a first-party SDK. The generated client will always reflect the current spec when you regenerate it.

If you would find a first-party SDK useful, email [email protected] with your language and use case — this informs our roadmap.

See also: OpenAPI Specification for import and generation instructions, and Authentication for the full OIDC walkthrough.

SDK & Tools